# In Suricata IDS mode. is it possible to block/drop/pass good traffic so it will not be seen in kibana?

**URL:** <https://forum.suricata.io/t/in-suricata-ids-mode-is-it-possible-to-block-drop-pass-good-traffic-so-it-will-not-be-seen-in-kibana/1666>\
**Category:** Rules\
**Tags:** ips\
**Created:** [August 30, 2021, 10:44pm UTC](https://forum.suricata.io/t/in-suricata-ids-mode-is-it-possible-to-block-drop-pass-good-traffic-so-it-will-not-be-seen-in-kibana/1666 "2021-08-30T22:44:13Z")\
**Posts on this page:** 1\
**Showing post:** 12

<div class="post-metadata">

**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\
**Post date:** [January 3, 2023, 1:46pm UTC](https://forum.suricata.io/t/in-suricata-ids-mode-is-it-possible-to-block-drop-pass-good-traffic-so-it-will-not-be-seen-in-kibana/1666/12 "2023-01-03T13:46:15Z")

</div>

Hi,  
You can separate alerts into a separate output file.

If I understand your question, you’d like to separate logging information from alerts. If that’s correct,  
use multiple `eve-log` sections in your Suricata configuration file `suricata.yaml`.

Here’s a [link](https://forum.suricata.io/t/logging-different-kind-of-logs-in-different-eve-files/329/2) to an older forum post where this is presented.

---

_[View the full topic](https://forum.suricata.io/t/in-suricata-ids-mode-is-it-possible-to-block-drop-pass-good-traffic-so-it-will-not-be-seen-in-kibana/1666)._