I am having issues with Suricata 6.0.4 with converting the eve.json file to readable (or csv) format. Each of the tools I have tested has choked on the eve.json input. any suggestions on what others are using?
What kind of issues are you having?
Separately, please consider upgrading your Suricata version – 6.0.4 is out of date; 6.0.9 is the latest stable version; see Download - Suricata
Thank you. I will update the Suricata software and retry.
Filebeat and Logstash are common tools these days that support the JSON format. Syslog-NG and rsyslog may be able to as well if configured properly.
There is no straightforward conversion from JSON to CSV as JSON is rich structured data with subobjects and arrays. If CSV is really needed, a custom conversion tool would probably be required to create the type of CSV your tooling requires.