What are the default Suricata logs

Does RockNSM use Eve.Json as its main source, or does it use Unified2? Or does it use both. Sorry looking through some files that look to be RockNSM that have both Eve and Unified.
Currently having issues with only stats showing in the eve.json, and some rules fired in the fast.log trying to narrow it all down.

I do see a eve.json and unified.logs in suricata.

The intent is that all data is going to eve.json. This is the only file being pushed up to Kafka by filebeat. We have left fast and unified logs on by default for easier CLI usage and as a possible integration point. Those will likely be disabled in the future by default to minimize disk I/O and disk space usage.

This is configured in /etc/suricata/rocknsm-overrides.yaml. All the RockNSM logs are written to /data/suricata, not the default Suricata path of /var/lib/suricata.