Thks @syoc and @vjulien I add another output .json in the suricata.yaml with only the alerts that I send in my SIEM.