Ah, great thanks.
So for the output config in Suricata.Yaml for the EVE log I intend to collect data from I want something like this?
Extensible Event Format (nicknamed EVE) event log in JSON format
- eve-log:
enabled: yes
filetype: unix_dgram
filename: [name of configured socket]
Thanks again for your help.