Logging different kind of logs in different EVE files

Help
1

Goodmorning everyone!
Is there a way to have different kind of EVE logs in different files? Like, alerts logs in eve.json, http logs in eve1.json, dns logs in eve2.json and so on?
Thanks in advance

2

Yes. Just do multiple eve-log definitions:

outputs:
     eve-log:
          filename: dns.log
          enabled:yes
          types:
                - dns
     eve-log:
              [....]
3

I tried before asking but I got something like a “unexpected key in suricata.yaml” error. I just supposed it couldn’t be that easy, but seing your answer I retried and it works. Guess I wrote it wrong the first time. Thanks!