Suricatasc -c dump-counters parsing

New to the forum, so be kind.

What format (json??) is the output from suricatasc -c dump-counters and how might one parse the output?

My goal is to be able to select specific counters, such as kernel_packets & kernel_drops and/or any others that will help keep an eye on packet throughput issues for tuning purposes.

I am aware of stats.log, but I’m trying to avoid having to deal with log sizes and log rotation processes. I’m running suricata on a consumer router (Asuswrt Merlin) and trying to minimize impact on disk space associated with logs. The setup is working well in IDS mode!!

It is JSON, so for example, using jq you could do something like:

suricatasc -c dump-counters | jq .message.capture.kernel_packets

and get:


Awesome and THANKS!!