I've got JSON output implemented (using libjansson) for http, smtp, ftp and dns already.  I also modifed regit's stuff here to use libjansson as well.  I've also got code to do json formatted alerting.  Its all currently held on individual branches at https://github.com/decanio/suricata-np on things like branch dev-http-json.  I plan on getting this all to you soon.

I used the same thing as Regit's json: yes.  I also added json: syslog so that JSON formatted output could be routed through syslog.

I'm ok with changing the .yaml stuff to whatever makes sense to everybody.