pid_suricata-dir_fast.log

 3170     1 root     S     637m  34%   3   0% {Suricata-Main} /usr/bin/suricata --pidfile /var/run/suricata.pid -D -q 0 -c /etc/suricata/suricata.yaml

default-log-dir = /var/log/suricata/
outputs.0.fast.filename = fast.log

# suricata-update - enable.conf
1000001
group:emerging*

# suricata-update - modify.conf
re:. ^alert drop
re:classtype:trojan-activity "(alert)(.*)" "drop\\2"