Does RockNSM use Eve.Json as its main source, or does it use Unified2? Or does it use both. Sorry looking through some files that look to be RockNSM that have both Eve and Unified.
Currently having issues with only stats showing in the eve.json, and some rules fired in the fast.log trying to narrow it all down.
I do see a eve.json and unified.logs in suricata.