Is there a way to have different kind of EVE logs in different files? Like, alerts logs in eve.json, http logs in eve1.json, dns logs in eve2.json and so on?
Thanks in advance
Yes. Just do multiple eve-log definitions:
outputs: eve-log: filename: dns.log enabled:yes types: - dns eve-log: [....]
I tried before asking but I got something like a “unexpected key in suricata.yaml” error. I just supposed it couldn’t be that easy, but seing your answer I retried and it works. Guess I wrote it wrong the first time. Thanks!