Logstash JSON logging in Apache, using mod_macro. Debugged and enhanced from the original version found at: http://cookbook.logstash.net/recipes/apache-json-logs/

logstash_apache_json_macro.conf

# logstash_apache_json_macro.conf
#
# Create a Macro named logstash_log that is used in the VirtualHost
# It defines, on the fly, a macro for the specific vhost $servername
# and anchors its @source, $source_host and @source_path.
#
# In addition, it prevents any non-page resources from getting logged.
#
# It also adds three tags: web, apache, and the servername
#
# Requires: mod_macro.so
#
# Usage:
#    Use logstash_log www.example.com hostname.example.com

<Macro logstash_log ${servername} ${hostname}>
  setenvIf Request_URI "(?i).(jpg|jpeg|png|css|gif|ico|js|woff)$" dontlog
  LogFormat "{ \
\"@source\":\"file ://${hostname}//var/log/httpd/${servername}-access_log.json\",\"@source_host\": \"${hostname}\", \
\"@source_path\": \"/var/log/httpd/${servername}-access_log.json\", \
\"@tags\":[\"web\",\"apache\",\"${servername}\"], \
\"@message\": \"%h %l %u %t \\\"%r\\\" %>s %b\", \
\"@fields\": { \
\"timestamp\": \"%{%Y-%m-%dT%H:%M:%S%z}t\", \
\"clientip\": \"%a\", \
\"duration\": %D, \
\"status\": %>s, \
\"request\": \"%U%q\", \
\"urlpath\": \"%U\", \
\"urlquery\": \"%q\", \
\"useragent\": \"%{User-agent}i\", \
\"referer\": \"%{Referer}i\", \
\"method\": \"%m\", \
\"bytes\": %B, \
\"vhost\": \"%v\" \
} \
}" logstash_apache_json

  CustomLog /var/log/httpd/${servername}-access_log.json logstash_apache_json env=!dontlog
</Macro>