send suricata logs to ntopng using syslog-ng

syslog-ng_suricata_ntopng.conf

# send suricata logs to ntopng with syslog-ng
#
# this is just one part of the puzzle... 
# - suricata needs to be configured (extra eve log) in one yaml.conf
# - ntop in a few places, plus knowing where to look to see that it works...
#  - once configured:
#    - select the syslog interface.
#    - click flows
#    - select status drop-down and click external alert to see what suricata is reporting

# https://www.ntop.org/wp-content/uploads/2019/10/Suricon_2019.pdf
# https://www.ntop.org/guides/ntopng/advanced_features/suricata.html

filter f_suricata { program(suricata) and not filter(f_debug); };
destination d_ntopng { tcp("127.0.0.1" port(9999) log_fifo_size(1000)); };
destination d_suricatatest { file("/var/log/suricata_test.log"); };
log { source(s_src); filter(f_suricata); destination(d_ntopng); };
#log { source(s_src); filter(f_suricata); destination(d_suricatatest); };