Eve.json how to display only rules alert

Rules
1

I want eve.json contains only packages which trigger my rules, let’s say this one:
alert udp any any → any any (msg:“UDP GGA message found”; content: “GGA”; sid: 3000;)

At the moment this is the config of eve.json:

stats:
enabled: yes
interval: 8

outputs:

  • eve-log:
    enabled: yes
    filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
    filename: eve.json
    level: Alert ← I change this from “Info” to “Alert”

However I still get eve.json updated every 8 seconds (the interval) with the stats log like this:

{“timestamp”:“2021-05-04T12:55:44.548639+0000”,“event_type”:“stats”,“stats”: {etc… etc…}}

I tried to set stats.enabled: no but it gives an error on start up.
I also tried stats.decoder-events: false but it still write events every interval value seconds.

How can I avoid this?
Thank you in advance!

2

Look a little further down in the config under the eve-log section. You will see:

types:
  - alert: ...
  - anomaly: ...

this is where you can remove event types that you don’t want to see in the output.

3

Thak you so much!
That worked!