diff --git a/doc/userguide/output/eve/eve-json-output.rst b/doc/userguide/output/eve/eve-json-output.rst index b49bca44f5..a195a021bd 100644 --- a/doc/userguide/output/eve/eve-json-output.rst +++ b/doc/userguide/output/eve/eve-json-output.rst @@ -27,8 +27,8 @@ Output types:: filetype: regular #regular|syslog|unix_dgram|unix_stream|redis filename: eve.json - # Enable for multi-threaded eve.json output; output files are suffixed - # with an identifier, e.g., eve.json.9.. Default: off + # Enable for multi-threaded eve.json output; output files are amended + # with an identifier, e.g., eve.9.json. Default: off #threaded: off #prefix: "@cee: " # prefix to prepend to each log entry # the following are valid when type: syslog above @@ -309,7 +309,10 @@ Threaded file output ~~~~~~~~~~~~~~~~~~~~ By default, all output is written to the named filename in the outputs section. The ``threaded`` option enables -each output thread to write to individual files prefixed with the configured ``filenmae``. +each output thread to write to individual files. In this case, the ``filename`` will include a unique identifier. + +With ``threaded`` enabled, the output will be split among many files -- and +the aggregate of each file's contents must be treated together. :: @@ -319,10 +322,8 @@ each output thread to write to individual files prefixed with the configured ``f threaded: on This example will cause each Suricata thread to write to its own "eve.json" file. Filenames are constructed -by adding a suffix with the thread id. For example, the thread with id 7 would write to `eve.json.7`. +by adding a unique identifier to the filename. For example, ``eve.7.json``. -With ``threaded`` enabled, the output will be split among many files -- each having the same prefix and a unique suffix -- and -the aggregate of each file's contents must be treated together. Rotate log file ~~~~~~~~~~~~~~~ diff --git a/doc/userguide/partials/eve-log.yaml b/doc/userguide/partials/eve-log.yaml index d90e409eaf..216763d908 100644 --- a/doc/userguide/partials/eve-log.yaml +++ b/doc/userguide/partials/eve-log.yaml @@ -4,8 +4,8 @@ outputs: enabled: yes filetype: regular #regular|syslog|unix_dgram|unix_stream|redis filename: eve.json - # Enable for multi-threaded eve.json output; output files are suffixed - # with an identifier, e.g., eve.json.9. + # Enable for multi-threaded eve.json output; output files are amended + # with an identifier, e.g., eve.9.json #threaded: false #prefix: "@cee: " # prefix to prepend to each log entry # the following are valid when type: syslog above