Suricata

I could imagine 2 types of solutions here:

1. add some kind of output filtering to the logger (e.g. pattern/regex match)
2. allow rules to control such logging.

Personally I would prefer the latter although it's a more invasive change.

I noticed this issue with the eve-log also. Enabling file magic and hash logging to syslog for example results in logs for all filetypes despite having only one alert rule for Win32 PE files. I'd like it to only log the PE files.

Friendly ping on this?

Have you looked into the config keyword to be able to do this ?