Shipping Suricata Logs from the Docker Container to Elastic SIEM

Which Docker image do you use? It will depend partly on which Docker you used, but the process is much the same.

You’ll likely need to export /var/log/suricata as a volume. For example:

docker run -v /data/suricata/logs:/var/log/suricata ...

this will make /data/suricata/logs map to /var/log/suricata inside the container, so on the host you can now see the logs at /data/suricata/logs, which you can then point Logstash, Filebeat, or whatever at to send the logs somewhere.