title: Parse Apache2 Error logs with Grok for Logstash
body: <p>Im trying to parse my apache2 error log and im having a bit of trouble.. It doesnt seem to be matching the filter. Im pretty sure the timestamp piece is wrong, but im not sure, and i cant really find any documentation to figure it out. Also, is there a way to get what is in <code>fields.errmsg</code> to me <code>@message</code>?</p>
  
  <p><strong>Log</strong></p>
  
  <pre><code>[Wed Jun 26 22:13:22 2013] [error] [client 10.10.10.100] PHP Fatal error:  Uncaught exception '\Foo\Bar'
  </code></pre>
  
  <p><strong>Shipper Config</strong></p>
  
  <pre><code>input {
          file {
                  'path' =&gt; '/var/log/apache2/*-error.log'
                  'type' =&gt; 'apache-error'
          }
  
  }
  
  filter {
          grok {
                  type =&gt; "apache-error"
                  pattern =&gt; "\[%{HTTPDATE:timestamp}\] \[%{WORD:class}\] \[%{WORD:originator} %{IP:clientip}\] %{GREEDYDATA:errmsg}"
          }
  }
  
  
  output {
          stdout {}
          redis {
                  'data_type' =&gt; 'list'
                  'host' =&gt; 'logstash.server.net'
                  'key' =&gt; 'logstash'
          }
  }
  </code></pre>