OK thanks.
The code will run on the same machine that is hosting suricata and I need the code to trigger the instant the alert comes in. Is it possible to configure an eve.json with a Unix domain socket that my code listens on so it will trigger as soon as the alert appears in that log or is there an easier way?