# Elasticsearch generates lots of Suricate events
**URL:** https://discuss.elastic.co/t/elasticsearch-generates-lots-of-suricate-events/37638
**Category:** Elasticsearch
**Created:** [December 20, 2015, 5:01am UTC](https://discuss.elastic.co/t/elasticsearch-generates-lots-of-suricate-events/37638 "2015-12-20T05:01:13Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@NullOranje](https://discuss.elastic.co/u/NullOranje)
#### Post date: [December 20, 2015, 5:01am UTC](https://discuss.elastic.co/t/elasticsearch-generates-lots-of-suricate-events/37638/1 "2015-12-20T05:01:13Z")
I've setup an ELK stack to parse Suricate log events, but I'm having a problem with Elasticsearch generating too much data. Every few seconds, it generates several log events such as
> {"timestamp":"2015-12-20T04:56:07.588866","event\_type":"fileinfo","src\_ip":"127.0.0.1","src\_port":40901,"dest\_ip":"127.0.0.1","dest\_port":9200,"proto":"TCP","http":{"url":"/\_bulk","hostname":"localhost","http\_user\_agent":"Manticore 0.4.4"},"fileinfo":{"filename":"/\_bulk","magic":"ASCII text, with very long lines","state":"CLOSED","stored":false,"size":3898}}
> {"timestamp":"2015-12-20T04:56:07.599335","event\_type":"http","src\_ip":"127.0.0.1","src\_port":40901,"dest\_ip":"127.0.0.1","dest\_port":9200,"proto":"TCP","http":{"hostname":"localhost","url":"/\_bulk","http\_user\_agent":"Manticore 0.4.4","accept\_encoding":"gzip,deflate"}}
I'm not sure how to suppress this information. Thoughts?
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [December 21, 2015, 3:21am UTC](https://discuss.elastic.co/t/elasticsearch-generates-lots-of-suricate-events/37638/2 "2015-12-21T03:21:12Z")
The only way to suppress it is to not send it to ES.
You could put LS in the mix and then filter these out.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 11:29pm UTC](https://discuss.elastic.co/t/elasticsearch-generates-lots-of-suricate-events/37638/3 "2017-07-05T23:29:42Z")