adapted to suricata fast.log