diff --git a/salt/filebeat/etc/filebeat.yml b/salt/filebeat/etc/filebeat.yml
index 59f70d27b..cabb0b719 100644
--- a/salt/filebeat/etc/filebeat.yml
+++ b/salt/filebeat/etc/filebeat.yml
@@ -296,6 +296,7 @@ filebeat.prospectors:
   # Make sure not file is defined twice as this can lead to unexpected behaviour.
   paths:
     - /nsm/bro/spool/*.log
+    - /suricata/eve.json
     #- c:\programdata\elasticsearch\logs\*
 
   # Configure the file encoding for reading files with international characters
diff --git a/salt/filebeat/init.sls b/salt/filebeat/init.sls
index f64586bd7..5749c73bb 100644
--- a/salt/filebeat/init.sls
+++ b/salt/filebeat/init.sls
@@ -58,6 +58,7 @@ so-filebeat:
       - /opt/so/log/filebeat:/var/log/filebeat:rw
       - /opt/so/conf/filebeat/etc/filebeat.yml:/usr/share/filebeat/filebeat.yml:ro
       - /nsm/bro/spool/manager:/nsm/bro/spool:ro
+      - /opt/so/log/suricata:/suricata:ro
       - /opt/so/conf/filebeat/etc/pki/filebeat.crt:/usr/share/filebeat/filebeat.crt:ro
       - /opt/so/conf/filebeat/etc/pki/filebeat.key:/usr/share/filebeat/filebeat.key:ro
       - /etc/ssl/certs/intca.crt:/usr/share/filebeat/intraca.crt:ro