# Kafka Output Not Working in Suricata 7.0.6

**URL:** <https://forum.suricata.io/t/kafka-output-not-working-in-suricata-7-0-6/5571>\
**Category:** Developers\
**Tags:** community, suricata\
**Created:** [April 1, 2025, 7:15am UTC](https://forum.suricata.io/t/kafka-output-not-working-in-suricata-7-0-6/5571 "2025-04-01T07:15:22Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![chirag.deshlehra](https://avatars.discourse-cdn.com/v4/letter/c/ac8455/32.png) [@chirag.deshlehra](https://forum.suricata.io/u/chirag.deshlehra)\
**Post date:** [April 1, 2025, 7:15am UTC](https://forum.suricata.io/t/kafka-output-not-working-in-suricata-7-0-6/5571/1 "2025-04-01T07:15:22Z")

</div>

Hi Team,

I am facing an issue while attempting to stream logs directly from Suricata to Kafka. I am currently using **Suricata version 7.0.6** , and I have configured Kafka output in the `suricata.yaml` file as follows:

outputs:

# Line-based alerts log similar to Snort’s fast.log

- fast:  
enabled: yes  
filename: fast.log  
append: yes

# Extensible Event Format (EVE) event log in JSON format

- eve-log:  
enabled: yes  
filetype: kafka #regular|syslog|unix\_dgram|unix\_stream|redis  
filename: eve.json  
kafka:  
brokers: [“17.X.X.X:9092”]  
topic: “suricatacdlogs”  
types:  
- alert:  
payload: yes  
packet: yes  
metadata: yes  
tagged-packets: yes  
pcap-file: yes  
pcap-file-path: full

However, when I run the test command: suricata -T -c /etc/suricata/suricata.yaml -v

I receive the following error:

Info: conf-yaml-loader: Configuration node ‘types’ redefined.  
Notice: suricata: This is Suricata version 7.0.6 RELEASE running in SYSTEM mode  
Info: cpu: CPUs/cores online: 8  
Info: suricata: Running suricata under test mode  
Info: suricata: Setting engine mode to IDS mode by default  
Info: exception-policy: master exception-policy set to: auto  
Info: logopenfile: fast output device (regular) initialized: fast.log  
Error: output-json: Invalid JSON output option: kafka

I also tested this configuration on **Suricata version 6.0.16** but encountered the same issue.

Could you please clarify whether **direct Kafka output** is still supported in Suricata 7.x, or if there is a recommended alternative for streaming logs directly to Kafka **without using third-party tools** like Filebeat or Fluentd?

Looking forward to your guidance.

---

<div class="post-metadata">

**Author:** ![vjulien](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/vjulien/32/4_2.png) [@vjulien](https://forum.suricata.io/u/vjulien)\
**Post date:** [April 1, 2025, 9:16am UTC](https://forum.suricata.io/t/kafka-output-not-working-in-suricata-7-0-6/5571/2 "2025-04-01T09:16:33Z")

</div>

Kafka is not supported. Some 3rd parties have offered this in the past, but it’s not part of upstream.

---

<div class="post-metadata">

**Author:** ![s1ncr](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/s1ncr/32/3450_2.png) [@s1ncr](https://forum.suricata.io/u/s1ncr)\
**Post date:** [April 1, 2025, 7:35pm UTC](https://forum.suricata.io/t/kafka-output-not-working-in-suricata-7-0-6/5571/3 "2025-04-01T19:35:01Z")

</div>

You can use Vector-dev to read logs from eve socket and forward events to kafka