A sample Logstash configuration for Suricata JSON output.

logstash_suricata_eve.conf

input {
   file { 
      path => [ "/usr/local/var/log/suricata/eve.json" ]
      codec =>   json 
   }
}

filter {
  if [src_ip]  {
    geoip {
      source => "src_ip"
      target => "geoip"
      # set database variable to full path to geoip database if you've got
      # the message: "You must specify 'database => ...' in your geoip filter"
      #database => "/path/to/GeoLiteCity.dat"
      add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
      add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}"  ]
    }
    mutate {
      convert => [ "[geoip][coordinates]", "float" ]
    }
  }
}

output { 
  stdout { codec => rubydebug }
  elasticsearch { embedded => true }
}