[[inputs.suricata]]
  ## Data sink for Suricata stats log.
  # This is expected to be a filename of a
  # unix socket to be created for listening.
  source = "/tmp/stats.sock"

  # Delimiter for flattening field keys, e.g. subitem "alert" of "detect"
  # becomes "detect_alert" when delimiter is "_".
  delimiter = "_"

- eve-log:
      enabled: yes
      filetype: unix_stream
      filename:  /tmp/stats.sock
      types:
        - stats:
            totals: no       # stats for all threads merged together
            threads: yes       # per thread stats

[...]
            totals: yes  
            threads: no
[...]