Hi Guys,
I am following the project for a while, congrats!
Yesterday we have released ModSecurity version 2.9.1. There was a modification in the logs that might affect you. The issue owasp-modsecurity/ModSecurity#840 contains more details about it.
Also, in v2.9.1 there is this possibility to save the audit logs in JSON format, not sure if the format is structured in the shape that you need for elasticsearch, but may be useful.