It is better to use a transformation to define the default
directory of output message instead of using an hardcoded value.
Same apply to the directory for the pid file.
# Default pid file.
# Will use this file if no --pidfile in command options.
-#pid-file: /var/run/suricata.pid
+#pid-file: @e_rundir@suricata.pid
# Daemon working directory
# Suricata will change directory to this one if provided
# type: json
- file:
enabled: no
- filename: /var/log/suricata.log
+ filename: @e_logdir@suricata.log
# type: json
- syslog:
enabled: no