It is necessary to pipe the error log to logger (and hence syslog-ng) because you cannot customize the error log in apache. Here we have a custom format which doesn't log IPs, but we still pipe it to logger because in syslog-ng we have more control over what and where we choose to log.

remove /etc/logrotate.d/apache

set these values in /etc/apache/httpd.conf:
LogFormat "%v \"%r\" %>s %b \"%{Referer}i\"" privacy_format
CustomLog "| logger -t apache -p daemon.info" privacy_for(p
ErrorLog "| logger -t apache -p daemon.err"
(replacing existing values).