GNU nano 3.2                                                                        /etc/filebeat/modules.d/suricata.yml

# Module: suricata
# Docs: https://www.elastic.co/guide/en/beats/filebeat/7.5/filebeat-module-suricata.html

- module: suricata
  # All logs
  eve:
    enabled: true
    eve.var.paths: ["/var/log/suricata/eve.json"]

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    #var.paths: