Suricata

out of curiosity: why would you want this? The eve.alert records are trivial to pass to ES, with fast.log you will need to some kind of parsing before passing it to ES somehow

Victor Julien wrote:

out of curiosity: why would you want this? The eve.alert records are trivial to pass to ES, with fast.log you will need to some kind of parsing before passing it to ES somehow

Thanks your replies. We want to visualize suricata's alerts with kibana.

I not sure I understand why you wouldn't just use the EVE alert records for this.

If you are still looking for a solution here, splitting out the alert might be helpful. the eve.json will be much easier to implement in an ELK stack and this way you can send it only the alerts if that is what you are looking for.

https://suricata.readthedocs.io/en/suricata-4.1.2/output/eve/eve-json-output.html#multiple-logger-instances

outputs:
  - eve-log:
      enabled: yes
      type: file
      filename: eve-ips.json
      types:
        - alert
        - drop