Fix log rotate on Suricata

salt/filebeat/etc/filebeat.yml

@@ -123,7 +123,7 @@ filebeat.inputs:
 
   - type: log
     paths:
-      - /suricata/eve.json
+      - /suricata/eve*.json
     fields:
       module: suricata
       dataset: common

salt/suricata/files/suricata.yaml

@@ -95,8 +95,8 @@ outputs:
   - eve-log:
       enabled: yes
       filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
-      filename: /nsm/eve.json
-      rotate-interval: day
+      filename: /nsm/eve-%Y-%m-%d-%H:%M.json
+      rotate-interval: hour
       
       #prefix: "@cee: " # prefix to prepend to each log entry
       # the following are valid when type: syslog above

salt/suricata/files/suricataMETA.yaml

@@ -95,7 +95,7 @@ outputs:
   - eve-log:
       enabled: yes
       filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
-      filename: /nsm/eve.json
+      filename: /nsm/eve-%Y-%m-%d-%H:%M.json
       rotate-interval: hour
       
       #prefix: "@cee: " # prefix to prepend to each log entry