# Suricata Agent Integration - Unable to grab eve.json

**URL:** <https://discuss.elastic.co/t/suricata-agent-integration-unable-to-grab-eve-json/277076>\
**Category:** Endpoint Security\
**Created:** [June 25, 2021, 3:00pm UTC](https://discuss.elastic.co/t/suricata-agent-integration-unable-to-grab-eve-json/277076 "2021-06-25T15:00:32Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Verax](https://avatars.discourse-cdn.com/v4/letter/v/7c8e57/32.png) [@Verax](https://discuss.elastic.co/u/Verax)\
**Post date:** [June 25, 2021, 3:00pm UTC](https://discuss.elastic.co/t/suricata-agent-integration-unable-to-grab-eve-json/277076/1 "2021-06-25T15:00:33Z")

</div>

Hello all,

I have successfully added the Elastic Agent to my security onion host and it is correctly grabbing the Zeek logs. However, the agent doesn’t seem to be able to pull the Suricata logs even though it was doing it previously.

My suricata logs are stored in /nsm/suricata and I have set this as the log path in the suricata integration policy. Could anyone help to confirm why this is not working please?

Please see attached the photos of my deployment and command line output.

Thank you!

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/8/78924fb8b0058420225f60f180ba5336defe618d.jpeg)  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/f/0fd86d012e924a2b0d51881f5babb5fcae3d80a8.jpeg)  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/8/c83791445db6313dcab71b20cb33476f16c2939b.jpeg)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 23, 2021, 3:01pm UTC](https://discuss.elastic.co/t/suricata-agent-integration-unable-to-grab-eve-json/277076/2 "2021-07-23T15:01:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.