From b662cf03ac6a2ed86083e180883002922da54c7a Mon Sep 17 00:00:00 2001
From: benrubson <ben.rubson@gmail.com>
Date: Fri, 17 Feb 2017 08:11:33 +0100
Subject: [PATCH] Apache, detect syslog prefix, simple example

---
 config/filter.d/apache-common.conf | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/config/filter.d/apache-common.conf b/config/filter.d/apache-common.conf
index 3d1f902b..b8c08ab2 100644
--- a/config/filter.d/apache-common.conf
+++ b/config/filter.d/apache-common.conf
@@ -1,6 +1,13 @@
 # Generic configuration items (to be used as interpolations) in other
 # apache filters.
 
+# If you use "ErrorLog syslog" in your Apache configuration,
+# you should then create the following apache-common.local file :
+# [INCLUDES]
+# before = common.conf
+# [DEFAULT]
+# _apache_prefix = %(__prefix_line)s
+
 [INCLUDES]
 
 # Load customizations if any available
@@ -8,7 +15,9 @@ after = apache-common.local
 
 [DEFAULT]
 
-_apache_error_client = \[\] \[(:?error|\S+:\S+)\]( \[pid \d+(:\S+ \d+)?\])? \[client <HOST>(:\d{1,5})?\]
+_apache_prefix = \[\]\s
+
+_apache_error_client = ^%(_apache_prefix)s\[(:?error|\S+:\S+)\]( \[pid \d+(:\S+ \d+)?\])? \[client <HOST>(:\d{1,5})?\]
 
 datepattern = {^LN-BEG}