Eve-log level settings?

Help
1

Can anyone explain what the level is used for here? Is there a list of what the different levels actually change or do?

I am trying to make adjustments and to the eve log and reduce some of the noise. I know that there are sections for -alerts and more below this section but I am trying to understand what level is used for.

  • eve-log:
    enabled: yes
    filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
    filename: eve.json
    # Enable for multi-threaded eve.json output; output files are amended
    # with an identifier, e.g., eve.9.json
    #threaded: false
    #prefix: "@cee: " # prefix to prepend to each log entry
    # the following are valid when type: syslog above
    #identity: “suricata”
    #facility: local5
    #level: Info ## possible levels: Emergency, Alert, Critical,
    ## Error, Warning, Notice, Info, Debug
2

level only applies when EVE entries are sent to syslog. Syslog uses level classifications to determine the handling of each message. Levels are builtin to syslog and are also referred to as severity levels. See Syslog - Wikipedia

To reduce “noise”, ensure that you’re only logging what you need. Each of the listed protocols in the output section can be disabled. You can also use “thresholds” to limit how often alerts are logged; see 6.31. Thresholding Keywords — Suricata 6.0.4 documentation