--snort-conf=/etc/snort/snort.conf
--directory=/var/log/snort
--prefix=snort.alert
--follow
--bookmark=/var/log/snort/u2json.mark
--delete
--output=/var/log/snort/alert.json