Write logstash config to match this modsecurity log in JSON format:

{"transaction":{"client_ip":"192.168.250.6","time_stamp":"Thu May 22 20:32:00 2025","server_id":"022d5b3351467cabff297d0ddb81cc6eed577194","client_port":50270,"host_ip":"10.100.2.2","host_port":80,"unique_id":"174796392061.751387","request":{"method":"GET","http_version":1.1,"uri":"/DVWA/setup.php","headers":{"host":"192.168.250.5","User-Agent":"Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0","Cookie":"security=high; PHPSESSID=0q63ami1iclbedipvotj2fopct","Priority":"u=0, i","Accept":"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8","Accept-Language":"en-US,en;q=0.5","Connection":"keep-alive","Referer":"http://192.168.250.5/DVWA/setup.php","Upgrade-Insecure-Requests":"1"}},"response":{"body":"<!DOCTYPE html>\n\n<html lang=\"en-GB\">\n\n\t<head>\n\t\t<meta http-equiv=\"Content-Type\" content=\"text/html; charset=UTF-8\" />\n\n\t\t<title>Setup :: Damn Vulnerable Web Application (DVWA)</title>\n\n\t\t<link rel=\"stylesheet\" type=\"text/css\" href=\"dvwa/css/main.css\" />\n\n\t\t<link rel=\"icon\" type=\"\\image/ico\" href=\"favicon.ico\" />\n\n\t\t<script type=\"text/javascript\" src=\"dvwa/js/dvwaPage.js\"></script>\n\n\t</head>\n\n\t<body class=\"home light\">\n\t\t<div id=\"container\">\n\n\t\t\t<div id=\"header\">\n\n\t\t\t\t<img src=\"dvwa/images/logo.png\" alt=\"Damn Vulnerable Web Application\" />\n                <a href=\"#\" onclick=\"javascript:toggleTheme();\" class=\"theme-icon\" title=\"Toggle theme between light and dark.\">\n                    <img src=\"dvwa/images/theme-light-dark.png\" alt=\"Damn Vulnerable Web Application\" />\n                </a>\n\t\t\t</div>\n\n\t\t\t<div id=\"main_menu\">\n\n\t\t\t\t<div id=\"main_menu_padded\">\n\t\t\t\t<ul class=\"menuBlocks\"><li class=\"\"><a href=\".\">Home</a></li>\n<li class=\"\"><a href=\"instructions.php\">Instructions</a></li>\n<li class=\"selected\"><a href=\"setup.php\">Setup / Reset DB</a></li>\n</ul><ul class=\"menuBlocks\"><li class=\"\"><a href=\"vulnerabilities/brute/\">Brute Force</a></li>\n<li class=\"\"><a href=\"vulnerabilities/exec/\">Command Injection</a></li>\n<li class=\"\"><a href=\"vulnerabilities/csrf/\">CSRF</a></li>\n<li class=\"\"><a href=\"vulnerabilities/fi/.?page=include.php\">File Inclusion</a></li>\n<li class=\"\"><a href=\"vulnerabilities/upload/\">File Upload</a></li>\n<li class=\"\"><a href=\"vulnerabilities/captcha/\">Insecure CAPTCHA</a></li>\n<li class=\"\"><a href=\"vulnerabilities/sqli/\">SQL Injection</a></li>\n<li class=\"\"><a href=\"vulnerabilities/sqli_blind/\">SQL Injection (Blind)</a></li>\n<li class=\"\"><a href=\"vulnerabilities/weak_id/\">Weak Session IDs</a></li>\n<li class=\"\"><a href=\"vulnerabilities/xss_d/\">XSS (DOM)</a></li>\n<li class=\"\"><a href=\"vulnerabilities/xss_r/\">XSS (Reflected)</a></li>\n<li class=\"\"><a href=\"vulnerabilities/xss_s/\">XSS (Stored)</a></li>\n<li class=\"\"><a href=\"vulnerabilities/csp/\">CSP Bypass</a></li>\n<li class=\"\"><a href=\"vulnerabilities/javascript/\">JavaScript</a></li>\n<li class=\"\"><a href=\"vulnerabilities/open_redirect/\">Open HTTP Redirect</a></li>\n<li class=\"\"><a href=\"vulnerabilities/cryptography/\">Cryptography</a></li>\n<li class=\"\"><a href=\"vulnerabilities/api/\">API</a></li>\n</ul><ul class=\"menuBlocks\"><li class=\"\"><a href=\"security.php\">DVWA Security</a></li>\n<li class=\"\"><a href=\"phpinfo.php\">PHP Info</a></li>\n<li class=\"\"><a href=\"about.php\">About</a></li>\n</ul><ul class=\"menuBlocks\"><li class=\"\"><a href=\"logout.php\">Logout</a></li>\n</ul>\n\t\t\t\t</div>\n\n\t\t\t</div>\n\n\t\t\t<div id=\"main_body\">\n\n\t\t\t\t\r\n<div class=\"body_padded\">\r\n\t<h1>Database Setup <img src=\"dvwa/images/spanner.png\" /></h1>\r\n\r\n\t<p>Click on the 'Create / Reset Database' button below to create or reset your database.<br />\r\n\tIf you get an error make sure you have the correct user credentials in: <em>/var/www/html/DVWA/config/config.inc.php</em></p>\r\n\r\n\t<p>If the database already exists, <em>it will be cleared and the data will be reset</em>.<br />\r\n\tYou can also use this to reset the administrator credentials (\"<em>admin</em> // <em>password</em>\") at any stage.</p>\r\n\t<hr />\r\n\t<br />\r\n\r\n\t<h2>Setup Check</h2>\r\n\r\n\t<em>General</em><br />\r\n\tOperating system: <em>*nix</em><br />\r\n\t<br>\r\n\tDVWA version: <ul><li>Git reference: <em>7e3508e2566a4ecb9bdbe69e367c386b34a1eb26</em></li><li>Date: <em>  Tue May 6 12:38:08 2025 +0100</em></li></ul>\r\n\t<br>\r\n\treCAPTCHA key: <span class=\"failure\">Missing</span><br />\r\n\t<br />\r\n\tWritable folder /var/www/html/DVWA/hackable/uploads/: <span class=\"success\">Yes</span><br />\r\n\tWritable folder /var/www/html/DVWA/config: <span class=\"success\">Yes</span>\r\n\t<br />\r\n\t<br>\r\n\r\n\t<em>Apache</em><br>\r\n\tWeb Server SERVER_NAME: <em>192.168.250.5</em><br /><br>\r\n\tmod_rewrite: <em><span class='failure'>Not Enabled</span></em><br>\r\n\tmod_rewrite is required for the AP labs.<br><br>\r\n\r\n\t<em>PHP</em><br>\r\n\tPHP version: <em>8.2.26</em><br />\r\n\t\r\n\tPHP function display_errors: <span class=\"success\">Enabled</span><br />\r\n\tPHP function display_startup_errors: <span class=\"success\">Enabled</span><br />\r\n\tPHP function allow_url_include: <span class=\"success\">Enabled</span><br/ >\r\n\tPHP function allow_url_fopen: <span class=\"success\">Enabled</span><br />\r\n\tPHP module gd: <span class=\"success\">Installed</span><br />\r\n\tPHP module mysql: <span class=\"success\">Installed</span><br />\r\n\tPHP module pdo_mysql: <span class=\"success\">Installed</span><br />\r\n\t<br />\r\n\t<em>Database</em><br>\r\n\tBackend database: <em>MySQL/MariaDB</em><br />\r\n\tDatabase username: <em>dvwa</em><br />\r\n\tDatabase password: <em>******</em><br />\r\n\tDatabase database: <em>dvwa</em><br />\r\n\tDatabase host: <em>127.0.0.1</em><br />\r\n\tDatabase port: <em>3306</em><br />\r\n\t<br />\r\n\t<em>API</em><br>\r\n\t<i>This section is only important if you want to use the API module.</i><br>\r\n\tVendor files installed: <em><span class='failure'>Not Installed</span></em><br><br>For information on how to install these, see the <a href='https://github.com/digininja/DVWA/blob/master/README.md#vendor-files'>README</a>.<br><br>\r\n\r\n\t<i><span class=\"failure\">Status in red</span>, indicate there will be an issue when trying to complete some modules.</i><br />\r\n\t<br />\r\n\tIf you see disabled on either <i>allow_url_fopen</i> or <i>allow_url_include</i>, set the following in your php.ini file and restart Apache.<br />\r\n\t<pre><code>allow_url_fopen = On\r\nallow_url_include = On</code></pre>\r\n\tThese are only required for the file inclusion labs so unless you want to play with those, you can ignore them.\r\n\r\n\t<br /><br /><br />\r\n\r\n\t<!-- Create db button -->\r\n\t<form action=\"#\" method=\"post\">\r\n\t\t<input name=\"create_db\" type=\"submit\" value=\"Create / Reset Database\">\r\n\t\t<input type='hidden' name='user_token' value='00debefbe4a9f6d4bc2d7687e4ca5554' />\r\n\t</form>\r\n\t<br />\r\n\t<hr />\r\n</div>\n\t\t\t\t<br /><br />\n\t\t\t\t\n\n\t\t\t</div>\n\n\t\t\t<div class=\"clear\">\n\t\t\t</div>\n\n\t\t\t<div id=\"system_info\">\n\t\t\t\t<div align=\"left\"><em>Username:</em> Unknown<br /><em>Security Level:</em> high<br /><em>Locale:</em> en<br /><em>SQLi DB:</em> mysql</div>\n\t\t\t</div>\n\n\t\t\t<div id=\"footer\">\n\n\t\t\t\t<p>Damn Vulnerable Web Application (DVWA)</p>\n\t\t\t\t<script src='dvwa/js/add_event_listeners.js'></script>\n\n\t\t\t</div>\n\n\t\t</div>\n\n\t</body>\n\n</html>","http_code":403,"headers":{"X-Frame-Options":"DENY","Vary":"Accept-Encoding","Pragma":"no-cache","Cache-Control":"no-cache, must-revalidate","Connection":"keep-alive","X-Content-Type-Options":"nosniff","Content-Type":"text/html;charset=utf-8","Expires":"Tue, 23 Jun 2009 12:00:00 GMT","Content-Length":"6264","Date":"Fri, 23 May 2025 01:32:00 GMT","Server":"nginx","Content-Security-Policy":"default-src 'self';"}},"producer":{"modsecurity":"ModSecurity v3.0.9 (Linux)","connector":"ModSecurity-nginx v1.0.3","secrules_engine":"Enabled","components":["OWASP_CRS/4.15.0-dev\""]},"messages":[{"message":"appinfo leak","details":{"match":"Matched \"Operator `Rx' with parameter `(?i)(mysql|password|passwd|can't connect|error|exception|trace|fatal|undefined|denied|unauthorized)' against variable `RESPONSE_BODY' (Value: `<!DOCTYPE html>\\x0a\\x0a<html lang=\"en-GB\">\\x0a\\x0a\\x09<head>\\x0a\\x09\\x09<meta http-equiv=\"Content-Ty (7304 characters omitted)' )","reference":"o2824,5o2824,5v411,6264","ruleId":"180003","file":"/etc/nginx/modsec/custom-rules/application-data-leaks.conf","lineNumber":"8","data":"","severity":"0","ver":"","rev":"","tags":["application-info-leak"],"maturity":"0","accuracy":"0"}}]}}