Hello,
I have seen that the eve.json filename can be formatted this way filename: eve-%Y-%m-%d-%H:%M:%S.json but I would be interested on a no-time-dependant identification. Something like eve-1.json for the first log, and eve-2.json for the second one, and so on, increasing each time a new log file is created. The purpose of this is having the log files in order without time consideration. Ideally it would be persistent, I mean, when suricata starts would check for past logs in the directory and continue the count from the biggest one.
I have been checking and didn`t find something like this but just to make sure: There is nothing like this, right? Or something I could achieve something similar with?
I also have been checking the code to see if I would be able to develop it myself, I am still trying to understand the code so I might be really wrong but to achieve what I want it would be something inside
SCLogFilenameFromPattern function or maybe an alternative function to this. Am I in the correct path?
By the way, I have been checking the 6.0.13 code, where did this go on the 7.0.x version?