Hi, here is my grok-pattern to parse the error log from apache, for me it works with a lot of error messages, also theses with no IP.
\[%{HTTPDERROR_DATE:timestamp}\] \[%{DATA:apache_error_module}:%{LOGLEVEL:log_level}\] \[pid %{POSINT:pid}(:tid %{NUMBER:tid})?\] (%{NOTSPACE:apache_error_file}:)?( )?(\[client %{IPORHOST:source_address}( )?(:%{NUMBER:source_port})?\])?( )?%{GREEDYDATA:message}
after you edit it, just add this to HTTPD_ERRORLOG, which should look like %{HTTPD20_ERRORLOG}|%{HTTPD24_ERRORLOG}|%{APACHE_ERRORLOG}