Suricata

This might just be a documentation thing that using stats type for eve requires enabled. It looks like if filename is not set, no file is written is disk.

I guess we still want to have the option to disable stats.log and just use the stats within EVE?!

Yeah, it's more of a documentation thing, since you can't just use the stats in eve by adding `- stats`, you also have to have stats enabled. If you don't want stats on disk, you have to make sure no stats filename is specified.

I think it's still confusing and documentation only helps a bit. Any thoughts on that from Victor?

I guess we could see if enabling stats in eve or as a separate log could automatically enable the global setting. It is a global thing because it is still usable over unix socket even if all outputs are disabled.