diff --git a/doc/userguide/devguide/extending/app-layer/transactions.rst b/doc/userguide/devguide/extending/app-layer/transactions.rst
index b93c8dac88cc..462558a67803 100644
--- a/doc/userguide/devguide/extending/app-layer/transactions.rst
+++ b/doc/userguide/devguide/extending/app-layer/transactions.rst
@@ -28,7 +28,7 @@ likely happen once per transaction, by the time of its completion. In other case
 
 In ``OutputTxLog``, the engine will compare current state with the value defined for the logging to happen, per flow
 direction (``logger->tc_log_progress``, ``logger->ts_log_progress``). If state is less than that value, the engine skips to
-the next logger. Code snippet from: suricata/src/output-tx.c:
+the next logger. Code snippet from: suricata/src/output/output-tx.c:
 
 .. code-block:: c
 
diff --git a/src/Makefile.am b/src/Makefile.am
index 1ec267327ee2..137fac8df986 100755
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -388,37 +388,37 @@ noinst_HEADERS = \
 	log-tcp-data.h \
 	app-layer/tls/log-tlslog.h \
 	app-layer/tls/log-tlsstore.h \
-	output-eve-stream.h \
-	output-eve-null.h \
-	output-filedata.h \
-	output-file.h \
-	output-filestore.h \
-	output-flow.h \
-	output.h \
-	output-json-alert.h \
-	output-json-anomaly.h \
+	output/eve/output-eve-stream.h \
+	output/eve/output-eve-null.h \
+	output/output-filedata.h \
+	output/output-file.h \
+	output/output-filestore.h \
+	output/output-flow.h \
+	output/output.h \
+	output/eve/output-json-alert.h \
+	output/eve/output-json-anomaly.h \
 	app-layer/bittorrent-dht/logger.h \
 	app-layer/dcerpc/logger.h \
 	app-layer/dhcp/logger.h \
 	app-layer/dnp3/logger.h \
 	app-layer/dnp3/logger-objects.h \
 	app-layer/dns/logger.h \
-	output-json-drop.h \
-	output-json-email-common.h \
-	output-json-file.h \
-	output-json-flow.h \
-	output-json-frame.h \
+	output/eve/output-json-drop.h \
+	output/eve/output-json-email-common.h \
+	output/eve/output-json-file.h \
+	output/eve/output-json-flow.h \
+	output/eve/output-json-frame.h \
 	app-layer/ftp/logger.h \
-	output-json.h \
+	output/eve/output-json.h \
 	app-layer/http2/logger.h \
 	app-layer/http/logger.h \
 	app-layer/ike/logger.h \
 	app-layer/krb5/logger.h \
-	output-json-metadata.h \
+	output/eve/output-json-metadata.h \
 	app-layer/modbus/logger.h \
 	app-layer/quic/logger.h \
 	app-layer/mqtt/logger.h \
-	output-json-netflow.h \
+	output/eve/output-json-netflow.h \
 	app-layer/nfs/logger.h \
 	app-layer/pgsql/logger.h \
 	app-layer/rdp/logger.h \
@@ -428,16 +428,16 @@ noinst_HEADERS = \
 	app-layer/smtp/logger.h \
 	app-layer/snmp/logger.h \
 	app-layer/ssh/logger.h \
-	output-json-stats.h \
+	output/eve/output-json-stats.h \
 	app-layer/template/logger.h \
 	app-layer/tftp/logger.h \
 	app-layer/tls/logger.h \
-	output-eve-syslog.h \
-	output-lua.h \
-	output-packet.h \
-	output-stats.h \
-	output-streaming.h \
-	output-tx.h \
+	output/eve/output-eve-syslog.h \
+	output/output-lua.h \
+	output/output-packet.h \
+	output/output-stats.h \
+	output/output-streaming.h \
+	output/output-tx.h \
 	packet.h \
 	packet-queue.h \
 	pkt-var.h \
@@ -1000,37 +1000,37 @@ libsuricata_c_a_SOURCES = \
 	log-tcp-data.c \
 	app-layer/tls/log-tlslog.c \
 	app-layer/tls/log-tlsstore.c \
-	output.c \
-	output-eve-stream.c \
-	output-file.c \
-	output-filedata.c \
-	output-filestore.c \
-	output-flow.c \
-	output-json-alert.c \
-	output-json-anomaly.c \
+	output/output.c \
+	output/eve/output-eve-stream.c \
+	output/output-file.c \
+	output/output-filedata.c \
+	output/output-filestore.c \
+	output/output-flow.c \
+	output/eve/output-json-alert.c \
+	output/eve/output-json-anomaly.c \
 	app-layer/bittorrent-dht/logger.c \
-	output-json.c \
-	output-json-common.c \
+	output/eve/output-json.c \
+	output/eve/output-json-common.c \
 	app-layer/dcerpc/logger.c \
 	app-layer/dhcp/logger.c \
 	app-layer/dnp3/logger.c \
 	app-layer/dnp3/logger-objects.c \
 	app-layer/dns/logger.c \
-	output-json-drop.c \
-	output-json-email-common.c \
-	output-json-file.c \
-	output-json-flow.c \
-	output-json-frame.c \
+	output/eve/output-json-drop.c \
+	output/eve/output-json-email-common.c \
+	output/eve/output-json-file.c \
+	output/eve/output-json-flow.c \
+	output/eve/output-json-frame.c \
 	app-layer/ftp/logger.c \
 	app-layer/http2/logger.c \
 	app-layer/http/logger.c \
 	app-layer/ike/logger.c \
 	app-layer/krb5/logger.c \
-	output-json-metadata.c \
+	output/eve/output-json-metadata.c \
 	app-layer/modbus/logger.c \
 	app-layer/quic/logger.c \
 	app-layer/mqtt/logger.c \
-	output-json-netflow.c \
+	output/eve/output-json-netflow.c \
 	app-layer/nfs/logger.c \
 	app-layer/pgsql/logger.c \
 	app-layer/rdp/logger.c \
@@ -1040,17 +1040,17 @@ libsuricata_c_a_SOURCES = \
 	app-layer/smtp/logger.c \
 	app-layer/snmp/logger.c \
 	app-layer/ssh/logger.c \
-	output-json-stats.c \
+	output/eve/output-json-stats.c \
 	app-layer/template/logger.c \
 	app-layer/tftp/logger.c \
 	app-layer/tls/logger.c \
-	output-eve-syslog.c \
-	output-eve-null.c \
-	output-lua.c \
-	output-packet.c \
-	output-stats.c \
-	output-streaming.c \
-	output-tx.c \
+	output/eve/output-eve-syslog.c \
+	output/eve/output-eve-null.c \
+	output/output-lua.c \
+	output/output-packet.c \
+	output/output-stats.c \
+	output/output-streaming.c \
+	output/output-tx.c \
 	packet.c \
 	packet-queue.c \
 	pkt-var.c \
diff --git a/src/alert-debuglog.c b/src/alert-debuglog.c
index a7880bef0d97..2b2aba1c5373 100644
--- a/src/alert-debuglog.c
+++ b/src/alert-debuglog.c
@@ -44,7 +44,7 @@
 #include "util-validate.h"
 #include "util-buffer.h"
 
-#include "output.h"
+#include "output/output.h"
 #include "alert-debuglog.h"
 #include "util-privs.h"
 #include "flow-var.h"
diff --git a/src/alert-fastlog.c b/src/alert-fastlog.c
index 96ffb7bc3773..d2f2d00e6afa 100644
--- a/src/alert-fastlog.c
+++ b/src/alert-fastlog.c
@@ -44,7 +44,7 @@
 #include "detect-reference.h"
 #include "util-classification-config.h"
 
-#include "output.h"
+#include "output/output.h"
 #include "alert-fastlog.h"
 
 #include "util-privs.h"
diff --git a/src/alert-syslog.c b/src/alert-syslog.c
index 1dce444ef9bc..a048276ef061 100644
--- a/src/alert-syslog.c
+++ b/src/alert-syslog.c
@@ -38,7 +38,7 @@
 #include "detect-engine-mpm.h"
 #include "detect-reference.h"
 
-#include "output.h"
+#include "output/output.h"
 #include "alert-syslog.h"
 
 #include "util-classification-config.h"
diff --git a/src/app-layer/bittorrent-dht/logger.c b/src/app-layer/bittorrent-dht/logger.c
index 232049866e1c..5cb775e9b5a6 100644
--- a/src/app-layer/bittorrent-dht/logger.c
+++ b/src/app-layer/bittorrent-dht/logger.c
@@ -35,8 +35,8 @@
 #include "util-debug.h"
 #include "util-byte.h"
 
-#include "output.h"
-#include "output-json.h"
+#include "output/output.h"
+#include "output/eve/output-json.h"
 
 #include "app-layer.h"
 #include "app-layer-parser.h"
diff --git a/src/app-layer/dcerpc/logger.c b/src/app-layer/dcerpc/logger.c
index 409293ee9394..af5e3826afc2 100644
--- a/src/app-layer/dcerpc/logger.c
+++ b/src/app-layer/dcerpc/logger.c
@@ -17,8 +17,8 @@
 
 #include "suricata-common.h"
 #include "util-buffer.h"
-#include "output.h"
-#include "output-json.h"
+#include "output/output.h"
+#include "output/eve/output-json.h"
 #include "app-layer-parser.h"
 #include "app-layer/dcerpc/logger.h"
 #include "rust.h"
diff --git a/src/app-layer/dhcp/logger.c b/src/app-layer/dhcp/logger.c
index 0a1674f93bdc..ea2703de6bed 100644
--- a/src/app-layer/dhcp/logger.c
+++ b/src/app-layer/dhcp/logger.c
@@ -35,8 +35,8 @@
 #include "util-debug.h"
 #include "util-byte.h"
 
-#include "output.h"
-#include "output-json.h"
+#include "output/output.h"
+#include "output/eve/output-json.h"
 
 #include "app-layer.h"
 #include "app-layer-parser.h"
diff --git a/src/app-layer/dnp3/logger-objects.c b/src/app-layer/dnp3/logger-objects.c
index 47733c732f9e..f837e481ae24 100644
--- a/src/app-layer/dnp3/logger-objects.c
+++ b/src/app-layer/dnp3/logger-objects.c
@@ -27,7 +27,7 @@
 #include "app-layer/dnp3/parser.h"
 #include "app-layer/dnp3/parser-objects.h"
 #include "app-layer/dnp3/logger-objects.h"
-#include "output-json.h"
+#include "output/eve/output-json.h"
 
 // clang-format off
 void OutputJsonDNP3SetItem(JsonBuilder *js, DNP3Object *object,
diff --git a/src/app-layer/dnp3/logger.c b/src/app-layer/dnp3/logger.c
index c7f1c8646981..0f0e5bf045fa 100644
--- a/src/app-layer/dnp3/logger.c
+++ b/src/app-layer/dnp3/logger.c
@@ -36,8 +36,8 @@
 
 #include "app-layer/dnp3/detect.h"
 
-#include "output.h"
-#include "output-json.h"
+#include "output/output.h"
+#include "output/eve/output-json.h"
 #include "app-layer/dnp3/logger.h"
 #include "app-layer/dnp3/logger-objects.h"
 
diff --git a/src/app-layer/dns/logger.c b/src/app-layer/dns/logger.c
index d19830e90ad3..1ac77509f38e 100644
--- a/src/app-layer/dns/logger.c
+++ b/src/app-layer/dns/logger.c
@@ -38,7 +38,7 @@
 #include "util-debug.h"
 #include "util-mem.h"
 #include "app-layer-parser.h"
-#include "output.h"
+#include "output/output.h"
 #include "app-layer.h"
 #include "util-privs.h"
 #include "util-buffer.h"
@@ -46,7 +46,7 @@
 #include "util-logopenfile.h"
 #include "util-time.h"
 
-#include "output-json.h"
+#include "output/eve/output-json.h"
 #include "app-layer/dns/logger.h"
 #include "rust.h"
 
diff --git a/src/app-layer/dns/lua.c b/src/app-layer/dns/lua.c
index ccd3b5f3fd56..c97351f7615b 100644
--- a/src/app-layer/dns/lua.c
+++ b/src/app-layer/dns/lua.c
@@ -36,7 +36,7 @@
 
 #include "util-debug.h"
 
-#include "output.h"
+#include "output/output.h"
 #include "app-layer.h"
 #include "app-layer-parser.h"
 #include "util-privs.h"
diff --git a/src/app-layer/ftp/logger.c b/src/app-layer/ftp/logger.c
index cdfb0356d961..ae6b818998d4 100644
--- a/src/app-layer/ftp/logger.c
+++ b/src/app-layer/ftp/logger.c
@@ -37,8 +37,8 @@
 #include "util-debug.h"
 #include "util-mem.h"
 
-#include "output.h"
-#include "output-json.h"
+#include "output/output.h"
+#include "output/eve/output-json.h"
 
 #include "app-layer.h"
 #include "app-layer-parser.h"
diff --git a/src/app-layer/http/log-httplog.c b/src/app-layer/http/log-httplog.c
index 483d2ec734f5..59a0bb1db6e6 100644
--- a/src/app-layer/http/log-httplog.c
+++ b/src/app-layer/http/log-httplog.c
@@ -38,7 +38,7 @@
 
 #include "util-debug.h"
 
-#include "output.h"
+#include "output/output.h"
 #include "app-layer/http/log-httplog.h"
 #include "app-layer/http/parser.h"
 #include "app-layer.h"
diff --git a/src/app-layer/http/logger.c b/src/app-layer/http/logger.c
index 1989039cb6db..aed190563074 100644
--- a/src/app-layer/http/logger.c
+++ b/src/app-layer/http/logger.c
@@ -37,7 +37,7 @@
 
 #include "util-debug.h"
 
-#include "output.h"
+#include "output/output.h"
 #include "app-layer/http/parser.h"
 #include "app-layer/http/parser-file.h"
 #include "app-layer/http/parser-xff.h"
@@ -48,8 +48,8 @@
 #include "util-proto-name.h"
 #include "util-logopenfile.h"
 #include "util-time.h"
-#include "output-json.h"
-#include "output-json-alert.h"
+#include "output/eve/output-json.h"
+#include "output/eve/output-json-alert.h"
 #include "app-layer/http/logger.h"
 #include "util-byte.h"
 
diff --git a/src/app-layer/http/lua.c b/src/app-layer/http/lua.c
index 7bfbb89bfc7a..dbfd56a5f27c 100644
--- a/src/app-layer/http/lua.c
+++ b/src/app-layer/http/lua.c
@@ -36,7 +36,7 @@
 
 #include "util-debug.h"
 
-#include "output.h"
+#include "output/output.h"
 #include "app-layer/http/parser.h"
 #include "app-layer.h"
 #include "app-layer-parser.h"
diff --git a/src/app-layer/http2/logger.c b/src/app-layer/http2/logger.c
index 76ff3e9a2458..f1dc747fd50c 100644
--- a/src/app-layer/http2/logger.c
+++ b/src/app-layer/http2/logger.c
@@ -37,7 +37,7 @@
 
 #include "util-debug.h"
 #include "app-layer-parser.h"
-#include "output.h"
+#include "output/output.h"
 #include "app-layer/http2/parser.h"
 #include "app-layer.h"
 #include "util-privs.h"
@@ -45,7 +45,7 @@
 
 #include "util-logopenfile.h"
 
-#include "output-json.h"
+#include "output/eve/output-json.h"
 #include "app-layer/http2/logger.h"
 #include "rust.h"
 
diff --git a/src/app-layer/ike/logger.c b/src/app-layer/ike/logger.c
index cd29ebed9e42..c5420ab3134b 100644
--- a/src/app-layer/ike/logger.c
+++ b/src/app-layer/ike/logger.c
@@ -38,8 +38,8 @@
 #include "util-debug.h"
 #include "util-byte.h"
 
-#include "output.h"
-#include "output-json.h"
+#include "output/output.h"
+#include "output/eve/output-json.h"
 
 #include "app-layer.h"
 #include "app-layer-parser.h"
diff --git a/src/app-layer/krb5/logger.c b/src/app-layer/krb5/logger.c
index ec54837ec1e8..5cd65185763a 100644
--- a/src/app-layer/krb5/logger.c
+++ b/src/app-layer/krb5/logger.c
@@ -37,8 +37,8 @@
 #include "util-debug.h"
 #include "util-byte.h"
 
-#include "output.h"
-#include "output-json.h"
+#include "output/output.h"
+#include "output/eve/output-json.h"
 
 #include "app-layer.h"
 #include "app-layer-parser.h"
diff --git a/src/app-layer/modbus/logger.c b/src/app-layer/modbus/logger.c
index 96e79632a218..2b88cf3238ba 100644
--- a/src/app-layer/modbus/logger.c
+++ b/src/app-layer/modbus/logger.c
@@ -26,8 +26,8 @@
 #include "util-buffer.h"
 #include "util-debug.h"
 #include "util-byte.h"
-#include "output.h"
-#include "output-json.h"
+#include "output/output.h"
+#include "output/eve/output-json.h"
 #include "app-layer.h"
 #include "app-layer-parser.h"
 #include "app-layer/modbus/logger.h"
diff --git a/src/app-layer/mqtt/logger.c b/src/app-layer/mqtt/logger.c
index b9798aab8849..8d5e4f3066b9 100644
--- a/src/app-layer/mqtt/logger.c
+++ b/src/app-layer/mqtt/logger.c
@@ -35,8 +35,8 @@
 #include "util-debug.h"
 #include "util-byte.h"
 
-#include "output.h"
-#include "output-json.h"
+#include "output/output.h"
+#include "output/eve/output-json.h"
 
 #include "app-layer.h"
 #include "app-layer-parser.h"
diff --git a/src/app-layer/nfs/logger.c b/src/app-layer/nfs/logger.c
index 26ea1bc55c1b..459069e8dd17 100644
--- a/src/app-layer/nfs/logger.c
+++ b/src/app-layer/nfs/logger.c
@@ -37,8 +37,8 @@
 #include "util-debug.h"
 #include "util-byte.h"
 
-#include "output.h"
-#include "output-json.h"
+#include "output/output.h"
+#include "output/eve/output-json.h"
 
 #include "app-layer.h"
 #include "app-layer-parser.h"
diff --git a/src/app-layer/pgsql/logger.c b/src/app-layer/pgsql/logger.c
index 807b799fc6a6..91bf4e590394 100644
--- a/src/app-layer/pgsql/logger.c
+++ b/src/app-layer/pgsql/logger.c
@@ -37,8 +37,8 @@
 #include "util-debug.h"
 #include "util-byte.h"
 
-#include "output.h"
-#include "output-json.h"
+#include "output/output.h"
+#include "output/eve/output-json.h"
 
 #include "app-layer.h"
 #include "app-layer-parser.h"
diff --git a/src/app-layer/quic/logger.c b/src/app-layer/quic/logger.c
index 0233fefa47a6..c60d73039224 100644
--- a/src/app-layer/quic/logger.c
+++ b/src/app-layer/quic/logger.c
@@ -32,8 +32,8 @@
 #include "util-buffer.h"
 #include "util-debug.h"
 #include "util-byte.h"
-#include "output.h"
-#include "output-json.h"
+#include "output/output.h"
+#include "output/eve/output-json.h"
 #include "app-layer.h"
 #include "app-layer-parser.h"
 #include "app-layer/quic/logger.h"
diff --git a/src/app-layer/rdp/logger.c b/src/app-layer/rdp/logger.c
index 751b92c096ac..fe633a0923d7 100644
--- a/src/app-layer/rdp/logger.c
+++ b/src/app-layer/rdp/logger.c
@@ -34,8 +34,8 @@
 #include "util-buffer.h"
 #include "util-debug.h"
 #include "util-byte.h"
-#include "output.h"
-#include "output-json.h"
+#include "output/output.h"
+#include "output/eve/output-json.h"
 #include "app-layer.h"
 #include "app-layer-parser.h"
 #include "app-layer/rdp/parser.h"
diff --git a/src/app-layer/rfb/logger.c b/src/app-layer/rfb/logger.c
index db87c19ebeb5..24989406e674 100644
--- a/src/app-layer/rfb/logger.c
+++ b/src/app-layer/rfb/logger.c
@@ -35,8 +35,8 @@
 #include "util-debug.h"
 #include "util-byte.h"
 
-#include "output.h"
-#include "output-json.h"
+#include "output/output.h"
+#include "output/eve/output-json.h"
 
 #include "app-layer.h"
 #include "app-layer-parser.h"
diff --git a/src/app-layer/sip/logger.c b/src/app-layer/sip/logger.c
index 040cb03efb4e..849977b81470 100644
--- a/src/app-layer/sip/logger.c
+++ b/src/app-layer/sip/logger.c
@@ -37,8 +37,8 @@
 #include "util-debug.h"
 #include "util-byte.h"
 
-#include "output.h"
-#include "output-json.h"
+#include "output/output.h"
+#include "output/eve/output-json.h"
 
 #include "app-layer.h"
 #include "app-layer-parser.h"
diff --git a/src/app-layer/smb/logger.c b/src/app-layer/smb/logger.c
index bac9f59f0474..6e103248b056 100644
--- a/src/app-layer/smb/logger.c
+++ b/src/app-layer/smb/logger.c
@@ -25,8 +25,8 @@
 
 #include "suricata-common.h"
 #include "util-buffer.h"
-#include "output.h"
-#include "output-json.h"
+#include "output/output.h"
+#include "output/eve/output-json.h"
 #include "app-layer-parser.h"
 #include "app-layer/smb/logger.h"
 #include "rust.h"
diff --git a/src/app-layer/smtp/logger.c b/src/app-layer/smtp/logger.c
index cf07702b9db7..53ec5eea6936 100644
--- a/src/app-layer/smtp/logger.c
+++ b/src/app-layer/smtp/logger.c
@@ -37,7 +37,7 @@
 
 #include "util-debug.h"
 
-#include "output.h"
+#include "output/output.h"
 #include "app-layer/smtp/parser.h"
 #include "app-layer.h"
 #include "app-layer-parser.h"
@@ -47,9 +47,9 @@
 #include "util-logopenfile.h"
 #include "util-time.h"
 
-#include "output-json.h"
+#include "output/eve/output-json.h"
 #include "app-layer/smtp/logger.h"
-#include "output-json-email-common.h"
+#include "output/eve/output-json-email-common.h"
 
 static void EveSmtpDataLogger(void *state, void *vtx, JsonBuilder *js)
 {
diff --git a/src/app-layer/smtp/lua.c b/src/app-layer/smtp/lua.c
index f379d926b806..fb0b78fc4805 100644
--- a/src/app-layer/smtp/lua.c
+++ b/src/app-layer/smtp/lua.c
@@ -32,7 +32,7 @@
 #include "threads.h"
 #include "threadvars.h"
 #include "tm-threads.h"
-#include "output.h"
+#include "output/output.h"
 
 #include "app-layer/smtp/parser.h"
 
diff --git a/src/app-layer/snmp/logger.c b/src/app-layer/snmp/logger.c
index fa6a25ad7d29..03595d7d51a6 100644
--- a/src/app-layer/snmp/logger.c
+++ b/src/app-layer/snmp/logger.c
@@ -37,8 +37,8 @@
 #include "util-debug.h"
 #include "util-byte.h"
 
-#include "output.h"
-#include "output-json.h"
+#include "output/output.h"
+#include "output/eve/output-json.h"
 
 #include "app-layer.h"
 #include "app-layer-parser.h"
diff --git a/src/app-layer/ssh/logger.c b/src/app-layer/ssh/logger.c
index fb604905012d..20a4c9194731 100644
--- a/src/app-layer/ssh/logger.c
+++ b/src/app-layer/ssh/logger.c
@@ -37,7 +37,7 @@
 
 #include "util-debug.h"
 #include "app-layer-parser.h"
-#include "output.h"
+#include "output/output.h"
 #include "app-layer/ssh/parser.h"
 #include "app-layer.h"
 #include "util-privs.h"
@@ -45,7 +45,7 @@
 
 #include "util-logopenfile.h"
 
-#include "output-json.h"
+#include "output/eve/output-json.h"
 #include "app-layer/ssh/logger.h"
 #include "rust.h"
 
diff --git a/src/app-layer/ssh/lua-hassh.c b/src/app-layer/ssh/lua-hassh.c
index 7b4e398e754b..3e2c29d01c59 100644
--- a/src/app-layer/ssh/lua-hassh.c
+++ b/src/app-layer/ssh/lua-hassh.c
@@ -36,7 +36,7 @@
 
 #include "util-debug.h"
 
-#include "output.h"
+#include "output/output.h"
 #include "app-layer.h"
 #include "app-layer-parser.h"
 #include "app-layer/ssl/parser.h"
diff --git a/src/app-layer/ssh/lua.c b/src/app-layer/ssh/lua.c
index fa6fb27b0fbb..03ac163906ee 100644
--- a/src/app-layer/ssh/lua.c
+++ b/src/app-layer/ssh/lua.c
@@ -36,7 +36,7 @@
 
 #include "util-debug.h"
 
-#include "output.h"
+#include "output/output.h"
 #include "app-layer.h"
 #include "app-layer-parser.h"
 #include "app-layer/ssh/parser.h"
diff --git a/src/app-layer/template/logger.c b/src/app-layer/template/logger.c
index ed33600bb996..293572e31138 100644
--- a/src/app-layer/template/logger.c
+++ b/src/app-layer/template/logger.c
@@ -43,8 +43,8 @@
 #include "util-debug.h"
 #include "util-byte.h"
 
-#include "output.h"
-#include "output-json.h"
+#include "output/output.h"
+#include "output/eve/output-json.h"
 
 #include "app-layer.h"
 #include "app-layer-parser.h"
diff --git a/src/app-layer/tftp/logger.c b/src/app-layer/tftp/logger.c
index 5912140fe3c8..db02a1334f03 100644
--- a/src/app-layer/tftp/logger.c
+++ b/src/app-layer/tftp/logger.c
@@ -37,8 +37,8 @@
 #include "util-debug.h"
 #include "util-byte.h"
 
-#include "output.h"
-#include "output-json.h"
+#include "output/output.h"
+#include "output/eve/output-json.h"
 
 #include "app-layer.h"
 #include "app-layer-parser.h"
diff --git a/src/app-layer/tls/log-tlslog.c b/src/app-layer/tls/log-tlslog.c
index f5f4112cc1a6..eb82b4d960a3 100644
--- a/src/app-layer/tls/log-tlslog.c
+++ b/src/app-layer/tls/log-tlslog.c
@@ -40,7 +40,7 @@
 
 #include "util-debug.h"
 
-#include "output.h"
+#include "output/output.h"
 #include "app-layer/tls/log-tlslog.h"
 #include "app-layer/ssl/parser.h"
 #include "app-layer.h"
diff --git a/src/app-layer/tls/log-tlsstore.c b/src/app-layer/tls/log-tlsstore.c
index 91ce26ae2720..c230197ae510 100644
--- a/src/app-layer/tls/log-tlsstore.c
+++ b/src/app-layer/tls/log-tlsstore.c
@@ -34,7 +34,7 @@
 #include "app-layer-parser.h"
 #include "app-layer/ssl/parser.h"
 
-#include "output.h"
+#include "output/output.h"
 #include "app-layer/tls/log-tlslog.h"
 
 #include "util-conf.h"
diff --git a/src/app-layer/tls/logger.c b/src/app-layer/tls/logger.c
index 2b5d06ee7d1a..f42d0f493a8c 100644
--- a/src/app-layer/tls/logger.c
+++ b/src/app-layer/tls/logger.c
@@ -38,7 +38,7 @@
 
 #include "util-debug.h"
 #include "app-layer-parser.h"
-#include "output.h"
+#include "output/output.h"
 #include "app-layer/ssl/parser.h"
 #include "app-layer.h"
 #include "util-privs.h"
@@ -47,7 +47,7 @@
 #include "util-logopenfile.h"
 #include "util-ja3.h"
 
-#include "output-json.h"
+#include "output/eve/output-json.h"
 #include "app-layer/tls/logger.h"
 
 SC_ATOMIC_EXTERN(unsigned int, cert_id);
diff --git a/src/app-layer/tls/lua.c b/src/app-layer/tls/lua.c
index cafa8bc11b3e..74e3f6a0e10e 100644
--- a/src/app-layer/tls/lua.c
+++ b/src/app-layer/tls/lua.c
@@ -36,7 +36,7 @@
 
 #include "util-debug.h"
 
-#include "output.h"
+#include "output/output.h"
 #include "app-layer.h"
 #include "app-layer-parser.h"
 #include "app-layer/ssl/parser.h"
diff --git a/src/counters.c b/src/counters.c
index 44d6f71f6466..97651d96de67 100644
--- a/src/counters.c
+++ b/src/counters.c
@@ -30,8 +30,8 @@
 #include "suricata.h"
 #include "threadvars.h"
 
-#include "output.h"
-#include "output-json-stats.h"
+#include "output/output.h"
+#include "output/eve/output-json-stats.h"
 
 #include "util-byte.h"
 #include "util-conf.h"
diff --git a/src/decode.c b/src/decode.c
index 4af65a24a14a..034b212265e2 100644
--- a/src/decode.c
+++ b/src/decode.c
@@ -54,7 +54,7 @@
 #include "flow-storage.h"
 #include "tmqh-packetpool.h"
 #include "app-layer.h"
-#include "output.h"
+#include "output/output.h"
 
 #include "decode-vxlan.h"
 #include "decode-geneve.h"
diff --git a/src/detect-config.c b/src/detect-config.c
index 5df603b6175b..c363b1490b6a 100644
--- a/src/detect-config.c
+++ b/src/detect-config.c
@@ -53,7 +53,7 @@
 
 #include "detect-config.h"
 
-#include "output.h"
+#include "output/output.h"
 
 /**
  * \brief Regex for parsing our flow options
diff --git a/src/detect-engine-profile.c b/src/detect-engine-profile.c
index 9ba861404368..ae2195403ce2 100644
--- a/src/detect-engine-profile.c
+++ b/src/detect-engine-profile.c
@@ -26,7 +26,7 @@
 #include "detect-engine-profile.h"
 
 #ifdef PROFILING
-#include "output-json.h"
+#include "output/eve/output-json.h"
 #include "util-conf.h"
 
 SCMutex g_rule_dump_write_m = SCMUTEX_INITIALIZER;
diff --git a/src/flow-hash.c b/src/flow-hash.c
index f8feedd99f3b..484b00ed1937 100644
--- a/src/flow-hash.c
+++ b/src/flow-hash.c
@@ -47,8 +47,8 @@
 #include "util-hash-lookup3.h"
 
 #include "conf.h"
-#include "output.h"
-#include "output-flow.h"
+#include "output/output.h"
+#include "output/output-flow.h"
 #include "stream-tcp.h"
 #include "util-exception-policy.h"
 
diff --git a/src/flow-manager.c b/src/flow-manager.c
index e49ef2659651..73bd20cc3c28 100644
--- a/src/flow-manager.c
+++ b/src/flow-manager.c
@@ -62,7 +62,7 @@
 #include "ippair-timeout.h"
 #include "app-layer/http/parser-range.h"
 
-#include "output-flow.h"
+#include "output/output-flow.h"
 
 #include "runmode-unix-socket.h"
 
diff --git a/src/flow-worker.c b/src/flow-worker.c
index 5a9fc7ad362b..603838998b6d 100644
--- a/src/flow-worker.c
+++ b/src/flow-worker.c
@@ -41,7 +41,7 @@
 #include "stream-tcp.h"
 #include "app-layer.h"
 #include "detect-engine.h"
-#include "output.h"
+#include "output/output.h"
 #include "app-layer-parser.h"
 #include "app-layer-frames.h"
 
diff --git a/src/log-pcap.c b/src/log-pcap.c
index 843a0b532770..fd5bdff37a1b 100644
--- a/src/log-pcap.c
+++ b/src/log-pcap.c
@@ -44,7 +44,7 @@
 #include "stream.h"
 #include "stream-tcp-reassemble.h"
 
-#include "output.h"
+#include "output/output.h"
 
 #include "util-buffer.h"
 #include "util-byte.h"
diff --git a/src/log-stats.c b/src/log-stats.c
index 7b09cf1cb3e0..e1ef8eb47229 100644
--- a/src/log-stats.c
+++ b/src/log-stats.c
@@ -36,7 +36,7 @@
 
 #include "util-debug.h"
 
-#include "output.h"
+#include "output/output.h"
 #include "log-stats.h"
 #include "util-privs.h"
 #include "util-buffer.h"
diff --git a/src/log-tcp-data.h b/src/log-tcp-data.h
index 608dbef3090a..322870ba07fa 100644
--- a/src/log-tcp-data.h
+++ b/src/log-tcp-data.h
@@ -25,7 +25,7 @@
 #define __LOG_TCPDATALOG_H__
 
 #include "conf.h"
-#include "output.h"
+#include "output/output.h"
 
 void LogTcpDataLogRegister(void);
 OutputInitResult LogTcpDataLogInitCtx(ConfNode *);
diff --git a/src/output-eve-null.c b/src/output/eve/output-eve-null.c
similarity index 96%
rename from src/output-eve-null.c
rename to src/output/eve/output-eve-null.c
index 1b62b96b36cb..0de3ab21d906 100644
--- a/src/output-eve-null.c
+++ b/src/output/eve/output-eve-null.c
@@ -25,8 +25,8 @@
 
 #include "suricata-common.h" /* errno.h, string.h, etc. */
 
-#include "output.h" /* DEFAULT_LOG_* */
-#include "output-eve-null.h"
+#include "output/output.h" /* DEFAULT_LOG_* */
+#include "output/eve/output-eve-null.h"
 
 #ifdef OS_WIN32
 void NullLogInitialize(void)
diff --git a/src/output-eve-null.h b/src/output/eve/output-eve-null.h
similarity index 100%
rename from src/output-eve-null.h
rename to src/output/eve/output-eve-null.h
diff --git a/src/output-eve-stream.c b/src/output/eve/output-eve-stream.c
similarity index 99%
rename from src/output-eve-stream.c
rename to src/output/eve/output-eve-stream.c
index 919505dce70d..5fd0cbcf886c 100644
--- a/src/output-eve-stream.c
+++ b/src/output/eve/output-eve-stream.c
@@ -36,10 +36,10 @@
 #include "detect-engine-mpm.h"
 #include "detect-reference.h"
 
-#include "output.h"
-#include "output-json.h"
-#include "output-json-flow.h"
-#include "output-eve-stream.h"
+#include "output/output.h"
+#include "output/eve/output-json.h"
+#include "output/eve/output-json-flow.h"
+#include "output/eve/output-eve-stream.h"
 
 #include "stream-tcp.h"
 
diff --git a/src/output-eve-stream.h b/src/output/eve/output-eve-stream.h
similarity index 100%
rename from src/output-eve-stream.h
rename to src/output/eve/output-eve-stream.h
diff --git a/src/output-eve-syslog.c b/src/output/eve/output-eve-syslog.c
similarity index 97%
rename from src/output-eve-syslog.c
rename to src/output/eve/output-eve-syslog.c
index 5d71b5d807d1..f0e1e5e136d4 100644
--- a/src/output-eve-syslog.c
+++ b/src/output/eve/output-eve-syslog.c
@@ -25,8 +25,8 @@
  */
 
 #include "suricata-common.h" /* errno.h, string.h, etc. */
-#include "output.h"          /* DEFAULT_LOG_* */
-#include "output-eve-syslog.h"
+#include "output/output.h"          /* DEFAULT_LOG_* */
+#include "output/eve/output-eve-syslog.h"
 #include "util-syslog.h"
 
 #ifdef OS_WIN32
diff --git a/src/output-eve-syslog.h b/src/output/eve/output-eve-syslog.h
similarity index 100%
rename from src/output-eve-syslog.h
rename to src/output/eve/output-eve-syslog.h
diff --git a/src/output-json-alert.c b/src/output/eve/output-json-alert.c
similarity index 99%
rename from src/output-json-alert.c
rename to src/output/eve/output-json-alert.c
index 834a6b137d2f..40bc606ceb67 100644
--- a/src/output-json-alert.c
+++ b/src/output/eve/output-json-alert.c
@@ -57,9 +57,9 @@
 #include "util-syslog.h"
 #include "log-pcap.h"
 
-#include "output.h"
-#include "output-json.h"
-#include "output-json-alert.h"
+#include "output/output.h"
+#include "output/eve/output-json.h"
+#include "output/eve/output-json-alert.h"
 #include "app-layer/dnp3/logger.h"
 #include "app-layer/dns/logger.h"
 #include "app-layer/http/logger.h"
@@ -67,16 +67,16 @@
 #include "app-layer/ssh/logger.h"
 #include "rust.h"
 #include "app-layer/smtp/logger.h"
-#include "output-json-email-common.h"
+#include "output/eve/output-json-email-common.h"
 #include "app-layer/nfs/logger.h"
 #include "app-layer/smb/logger.h"
-#include "output-json-flow.h"
+#include "output/eve/output-json-flow.h"
 #include "app-layer/sip/logger.h"
 #include "app-layer/rfb/logger.h"
 #include "app-layer/mqtt/logger.h"
 #include "app-layer/ike/logger.h"
 #include "app-layer/modbus/logger.h"
-#include "output-json-frame.h"
+#include "output/eve/output-json-frame.h"
 #include "app-layer/quic/logger.h"
 
 #include "util-byte.h"
diff --git a/src/output-json-alert.h b/src/output/eve/output-json-alert.h
similarity index 100%
rename from src/output-json-alert.h
rename to src/output/eve/output-json-alert.h
diff --git a/src/output-json-anomaly.c b/src/output/eve/output-json-anomaly.c
similarity index 99%
rename from src/output-json-anomaly.c
rename to src/output/eve/output-json-anomaly.c
index 91fe41f7f172..49aa89c9cc89 100644
--- a/src/output-json-anomaly.c
+++ b/src/output/eve/output-json-anomaly.c
@@ -43,9 +43,9 @@
 #include "detect-engine.h"
 #include "util-logopenfile.h"
 
-#include "output.h"
-#include "output-json.h"
-#include "output-json-anomaly.h"
+#include "output/output.h"
+#include "output/eve/output-json.h"
+#include "output/eve/output-json-anomaly.h"
 
 #include "util-byte.h"
 #include "util-enum.h"
diff --git a/src/output-json-anomaly.h b/src/output/eve/output-json-anomaly.h
similarity index 100%
rename from src/output-json-anomaly.h
rename to src/output/eve/output-json-anomaly.h
diff --git a/src/output-json-common.c b/src/output/eve/output-json-common.c
similarity index 98%
rename from src/output-json-common.c
rename to src/output/eve/output-json-common.c
index fcd7d0f7afd8..490bea1c5ea9 100644
--- a/src/output-json-common.c
+++ b/src/output/eve/output-json-common.c
@@ -22,8 +22,8 @@
  */
 
 #include "suricata-common.h"
-#include "output.h"
-#include "output-json.h"
+#include "output/output.h"
+#include "output/eve/output-json.h"
 #include "util-buffer.h"
 
 OutputJsonThreadCtx *CreateEveThreadCtx(ThreadVars *t, OutputJsonCtx *ctx)
diff --git a/src/output-json-drop.c b/src/output/eve/output-json-drop.c
similarity index 98%
rename from src/output-json-drop.c
rename to src/output/eve/output-json-drop.c
index ca106466ac66..dbad9b411818 100644
--- a/src/output-json-drop.c
+++ b/src/output/eve/output-json-drop.c
@@ -41,10 +41,10 @@
 #include "detect-engine-mpm.h"
 #include "detect-reference.h"
 
-#include "output.h"
-#include "output-json.h"
-#include "output-json-alert.h"
-#include "output-json-drop.h"
+#include "output/output.h"
+#include "output/eve/output-json.h"
+#include "output/eve/output-json-alert.h"
+#include "output/eve/output-json-drop.h"
 
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
diff --git a/src/output-json-drop.h b/src/output/eve/output-json-drop.h
similarity index 100%
rename from src/output-json-drop.h
rename to src/output/eve/output-json-drop.h
diff --git a/src/output-json-email-common.c b/src/output/eve/output-json-email-common.c
similarity index 99%
rename from src/output-json-email-common.c
rename to src/output/eve/output-json-email-common.c
index 821d9733f890..6b25498ccc7a 100644
--- a/src/output-json-email-common.c
+++ b/src/output/eve/output-json-email-common.c
@@ -40,7 +40,7 @@
 
 #include "util-debug.h"
 #include "app-layer-parser.h"
-#include "output.h"
+#include "output/output.h"
 #include "app-layer/smtp/parser.h"
 #include "app-layer.h"
 #include "util-privs.h"
@@ -49,8 +49,8 @@
 
 #include "util-logopenfile.h"
 
-#include "output-json.h"
-#include "output-json-email-common.h"
+#include "output/eve/output-json.h"
+#include "output/eve/output-json-email-common.h"
 
 #define LOG_EMAIL_DEFAULT     0
 #define LOG_EMAIL_EXTENDED    (1 << 0)
diff --git a/src/output-json-email-common.h b/src/output/eve/output-json-email-common.h
similarity index 100%
rename from src/output-json-email-common.h
rename to src/output/eve/output-json-email-common.h
diff --git a/src/output-json-file.c b/src/output/eve/output-json-file.c
similarity index 98%
rename from src/output-json-file.c
rename to src/output/eve/output-json-file.c
index 7f8012a23f75..c61aabdb67a4 100644
--- a/src/output-json-file.c
+++ b/src/output/eve/output-json-file.c
@@ -53,12 +53,12 @@
 
 #include "util-logopenfile.h"
 
-#include "output.h"
-#include "output-json.h"
-#include "output-json-file.h"
+#include "output/output.h"
+#include "output/eve/output-json.h"
+#include "output/eve/output-json-file.h"
 #include "app-layer/http/logger.h"
 #include "app-layer/smtp/logger.h"
-#include "output-json-email-common.h"
+#include "output/eve/output-json-email-common.h"
 #include "app-layer/nfs/logger.h"
 #include "app-layer/smb/logger.h"
 #include "app-layer/http2/logger.h"
diff --git a/src/output-json-file.h b/src/output/eve/output-json-file.h
similarity index 100%
rename from src/output-json-file.h
rename to src/output/eve/output-json-file.h
diff --git a/src/output-json-flow.c b/src/output/eve/output-json-flow.c
similarity index 99%
rename from src/output-json-flow.c
rename to src/output/eve/output-json-flow.c
index ce7efb98f22a..ad962dcc6210 100644
--- a/src/output-json-flow.c
+++ b/src/output/eve/output-json-flow.c
@@ -37,15 +37,15 @@
 
 #include "util-debug.h"
 
-#include "output.h"
+#include "output/output.h"
 #include "util-privs.h"
 #include "util-buffer.h"
 #include "util-device.h"
 #include "util-proto-name.h"
 #include "util-logopenfile.h"
 #include "util-time.h"
-#include "output-json.h"
-#include "output-json-flow.h"
+#include "output/eve/output-json.h"
+#include "output/eve/output-json-flow.h"
 
 #include "stream-tcp.h"
 #include "stream-tcp-private.h"
diff --git a/src/output-json-flow.h b/src/output/eve/output-json-flow.h
similarity index 100%
rename from src/output-json-flow.h
rename to src/output/eve/output-json-flow.h
diff --git a/src/output-json-frame.c b/src/output/eve/output-json-frame.c
similarity index 99%
rename from src/output-json-frame.c
rename to src/output/eve/output-json-frame.c
index 34d799cb4ed7..2b4d66f37de4 100644
--- a/src/output-json-frame.c
+++ b/src/output/eve/output-json-frame.c
@@ -53,9 +53,9 @@
 #include "util-classification-config.h"
 #include "stream-tcp.h"
 
-#include "output.h"
-#include "output-json.h"
-#include "output-json-frame.h"
+#include "output/output.h"
+#include "output/eve/output-json.h"
+#include "output/eve/output-json-frame.h"
 
 #include "util-byte.h"
 #include "util-privs.h"
diff --git a/src/output-json-frame.h b/src/output/eve/output-json-frame.h
similarity index 100%
rename from src/output-json-frame.h
rename to src/output/eve/output-json-frame.h
diff --git a/src/output-json-metadata.c b/src/output/eve/output-json-metadata.c
similarity index 96%
rename from src/output-json-metadata.c
rename to src/output/eve/output-json-metadata.c
index 8889851c6d64..5db2620cea1c 100644
--- a/src/output-json-metadata.c
+++ b/src/output/eve/output-json-metadata.c
@@ -50,9 +50,9 @@
 #include "util-syslog.h"
 #include "util-logopenfile.h"
 
-#include "output.h"
-#include "output-json.h"
-#include "output-json-metadata.h"
+#include "output/output.h"
+#include "output/eve/output-json.h"
+#include "output/eve/output-json-metadata.h"
 
 #include "util-byte.h"
 #include "util-privs.h"
diff --git a/src/output-json-metadata.h b/src/output/eve/output-json-metadata.h
similarity index 100%
rename from src/output-json-metadata.h
rename to src/output/eve/output-json-metadata.h
diff --git a/src/output-json-netflow.c b/src/output/eve/output-json-netflow.c
similarity index 98%
rename from src/output-json-netflow.c
rename to src/output/eve/output-json-netflow.c
index 79c705c4d73e..7489346fcc2a 100644
--- a/src/output-json-netflow.c
+++ b/src/output/eve/output-json-netflow.c
@@ -37,15 +37,15 @@
 
 #include "util-debug.h"
 
-#include "output.h"
+#include "output/output.h"
 #include "util-privs.h"
 #include "util-buffer.h"
 #include "util-device.h"
 #include "util-proto-name.h"
 #include "util-logopenfile.h"
 #include "util-time.h"
-#include "output-json.h"
-#include "output-json-netflow.h"
+#include "output/eve/output-json.h"
+#include "output/eve/output-json-netflow.h"
 
 #include "stream-tcp-private.h"
 
diff --git a/src/output-json-netflow.h b/src/output/eve/output-json-netflow.h
similarity index 100%
rename from src/output-json-netflow.h
rename to src/output/eve/output-json-netflow.h
diff --git a/src/output-json-stats.c b/src/output/eve/output-json-stats.c
similarity index 99%
rename from src/output-json-stats.c
rename to src/output/eve/output-json-stats.c
index 305a72d62154..c4e6712e94a9 100644
--- a/src/output-json-stats.c
+++ b/src/output/eve/output-json-stats.c
@@ -38,14 +38,14 @@
 #include "util-unittest.h"
 
 #include "util-debug.h"
-#include "output.h"
+#include "output/output.h"
 #include "util-privs.h"
 #include "util-buffer.h"
 
 #include "util-logopenfile.h"
 
-#include "output-json.h"
-#include "output-json-stats.h"
+#include "output/eve/output-json.h"
+#include "output/eve/output-json-stats.h"
 
 #define MODULE_NAME "JsonStatsLog"
 
diff --git a/src/output-json-stats.h b/src/output/eve/output-json-stats.h
similarity index 97%
rename from src/output-json-stats.h
rename to src/output/eve/output-json-stats.h
index 80f5cc2430d0..dc96060904eb 100644
--- a/src/output-json-stats.h
+++ b/src/output/eve/output-json-stats.h
@@ -24,7 +24,7 @@
 #ifndef __OUTPUT_JSON_COUNTERS_H__
 #define __OUTPUT_JSON_COUNTERS_H__
 
-#include "output-stats.h"
+#include "output/output-stats.h"
 
 #define JSON_STATS_TOTALS  (1 << 0)
 #define JSON_STATS_THREADS (1 << 1)
diff --git a/src/output-json.c b/src/output/eve/output-json.c
similarity index 99%
rename from src/output-json.c
rename to src/output/eve/output-json.c
index 223a03d31f99..a6c149d307bf 100644
--- a/src/output-json.c
+++ b/src/output/eve/output-json.c
@@ -49,11 +49,11 @@
 #include "util-syslog.h"
 
 /* Internal output plugins */
-#include "output-eve-syslog.h"
-#include "output-eve-null.h"
+#include "output/eve/output-eve-syslog.h"
+#include "output/eve/output-eve-null.h"
 
-#include "output.h"
-#include "output-json.h"
+#include "output/output.h"
+#include "output/eve/output-json.h"
 
 #include "util-byte.h"
 #include "util-privs.h"
diff --git a/src/output-json.h b/src/output/eve/output-json.h
similarity index 99%
rename from src/output-json.h
rename to src/output/eve/output-json.h
index 26a0e0d4c4dd..70b3637b954e 100644
--- a/src/output-json.h
+++ b/src/output/eve/output-json.h
@@ -27,7 +27,7 @@
 #include "suricata-common.h"
 #include "util-buffer.h"
 #include "util-logopenfile.h"
-#include "output.h"
+#include "output/output.h"
 #include "rust.h"
 
 #include "app-layer/http/parser-xff.h"
diff --git a/src/output-file.c b/src/output/output-file.c
similarity index 99%
rename from src/output-file.c
rename to src/output/output-file.c
index 706607729f0f..e02b9031c294 100644
--- a/src/output-file.c
+++ b/src/output/output-file.c
@@ -24,8 +24,8 @@
  */
 
 #include "suricata-common.h"
-#include "output.h"
-#include "output-file.h"
+#include "output/output.h"
+#include "output/output-file.h"
 #if 0
 #include "app-layer.h"
 #endif
diff --git a/src/output-file.h b/src/output/output-file.h
similarity index 100%
rename from src/output-file.h
rename to src/output/output-file.h
diff --git a/src/output-filedata.c b/src/output/output-filedata.c
similarity index 99%
rename from src/output-filedata.c
rename to src/output/output-filedata.c
index 50f075aa3fac..4eae8b69869f 100644
--- a/src/output-filedata.c
+++ b/src/output/output-filedata.c
@@ -24,8 +24,8 @@
  */
 
 #include "suricata-common.h"
-#include "output.h"
-#include "output-filedata.h"
+#include "output/output.h"
+#include "output/output-filedata.h"
 #include "app-layer-parser.h"
 #include "detect-filemagic.h"
 #include "conf.h"
diff --git a/src/output-filedata.h b/src/output/output-filedata.h
similarity index 100%
rename from src/output-filedata.h
rename to src/output/output-filedata.h
diff --git a/src/output-filestore.c b/src/output/output-filestore.c
similarity index 99%
rename from src/output-filestore.c
rename to src/output/output-filestore.c
index e877d0691e2e..3a8b6074a069 100644
--- a/src/output-filestore.c
+++ b/src/output/output-filestore.c
@@ -16,14 +16,14 @@
  */
 
 #include "suricata-common.h"
-#include "output-filestore.h"
+#include "output/output-filestore.h"
 
 #include "stream-tcp.h"
 
 #include "feature.h"
 
-#include "output.h"
-#include "output-json-file.h"
+#include "output/output.h"
+#include "output/eve/output-json-file.h"
 
 #include "util-conf.h"
 #include "util-misc.h"
diff --git a/src/output-filestore.h b/src/output/output-filestore.h
similarity index 100%
rename from src/output-filestore.h
rename to src/output/output-filestore.h
diff --git a/src/output-flow.c b/src/output/output-flow.c
similarity index 99%
rename from src/output-flow.c
rename to src/output/output-flow.c
index abd9986c58ab..ec1b79275b2a 100644
--- a/src/output-flow.c
+++ b/src/output/output-flow.c
@@ -24,8 +24,8 @@
  */
 
 #include "suricata-common.h"
-#include "output.h"
-#include "output-flow.h"
+#include "output/output.h"
+#include "output/output-flow.h"
 #include "util-profiling.h"
 #include "util-validate.h"
 
diff --git a/src/output-flow.h b/src/output/output-flow.h
similarity index 100%
rename from src/output-flow.h
rename to src/output/output-flow.h
diff --git a/src/output-lua.c b/src/output/output-lua.c
similarity index 99%
rename from src/output-lua.c
rename to src/output/output-lua.c
index 5f28d00fb0e5..e6ca1818a35e 100644
--- a/src/output-lua.c
+++ b/src/output/output-lua.c
@@ -23,13 +23,13 @@
  */
 
 #include "suricata-common.h"
-#include "output-lua.h"
+#include "output/output-lua.h"
 
 #ifdef HAVE_LUA
 #include "util-print.h"
 #include "util-unittest.h"
 #include "util-debug.h"
-#include "output.h"
+#include "output/output.h"
 #include "app-layer/http/parser.h"
 #include "app-layer.h"
 #include "app-layer/ssl/parser.h"
diff --git a/src/output-lua.h b/src/output/output-lua.h
similarity index 100%
rename from src/output-lua.h
rename to src/output/output-lua.h
diff --git a/src/output-packet.c b/src/output/output-packet.c
similarity index 99%
rename from src/output-packet.c
rename to src/output/output-packet.c
index 92ea7b50257e..28fec53867a4 100644
--- a/src/output-packet.c
+++ b/src/output/output-packet.c
@@ -24,8 +24,8 @@
  */
 
 #include "suricata-common.h"
-#include "output.h"
-#include "output-packet.h"
+#include "output/output.h"
+#include "output/output-packet.h"
 #include "util-profiling.h"
 #include "util-validate.h"
 
diff --git a/src/output-packet.h b/src/output/output-packet.h
similarity index 100%
rename from src/output-packet.h
rename to src/output/output-packet.h
diff --git a/src/output-stats.c b/src/output/output-stats.c
similarity index 99%
rename from src/output-stats.c
rename to src/output/output-stats.c
index 8c27b4dc9076..ee134718ce3d 100644
--- a/src/output-stats.c
+++ b/src/output/output-stats.c
@@ -24,8 +24,8 @@
  */
 
 #include "suricata-common.h"
-#include "output.h"
-#include "output-stats.h"
+#include "output/output.h"
+#include "output/output-stats.h"
 #include "util-validate.h"
 
 /** per thread data for this module, contains a list of per thread
diff --git a/src/output-stats.h b/src/output/output-stats.h
similarity index 100%
rename from src/output-stats.h
rename to src/output/output-stats.h
diff --git a/src/output-streaming.c b/src/output/output-streaming.c
similarity index 99%
rename from src/output-streaming.c
rename to src/output/output-streaming.c
index 07b7ef8875a0..b954e9b9fcfa 100644
--- a/src/output-streaming.c
+++ b/src/output/output-streaming.c
@@ -24,8 +24,8 @@
  */
 
 #include "suricata-common.h"
-#include "output.h"
-#include "output-streaming.h"
+#include "output/output.h"
+#include "output/output-streaming.h"
 #include "app-layer.h"
 #include "app-layer-parser.h"
 #include "app-layer/http/parser.h"
diff --git a/src/output-streaming.h b/src/output/output-streaming.h
similarity index 100%
rename from src/output-streaming.h
rename to src/output/output-streaming.h
diff --git a/src/output-tx.c b/src/output/output-tx.c
similarity index 99%
rename from src/output-tx.c
rename to src/output/output-tx.c
index bb58d032ed31..b8b25fb2ff66 100644
--- a/src/output-tx.c
+++ b/src/output/output-tx.c
@@ -24,8 +24,8 @@
  */
 
 #include "suricata-common.h"
-#include "output.h"
-#include "output-tx.h"
+#include "output/output.h"
+#include "output/output-tx.h"
 #include "stream.h"
 #include "app-layer.h"
 #include "app-layer-parser.h"
diff --git a/src/output-tx.h b/src/output/output-tx.h
similarity index 100%
rename from src/output-tx.h
rename to src/output/output-tx.h
diff --git a/src/output.c b/src/output/output.c
similarity index 98%
rename from src/output.c
rename to src/output/output.c
index 30e36545f4ce..81d4312f7f5d 100644
--- a/src/output.c
+++ b/src/output/output.c
@@ -38,19 +38,19 @@
 #include "tm-threads.h"
 #include "util-error.h"
 #include "util-debug.h"
-#include "output.h"
+#include "output/output.h"
 
 #include "alert-fastlog.h"
 #include "alert-debuglog.h"
 #include "alert-syslog.h"
-#include "output-json.h"
-#include "output-json-alert.h"
-#include "output-json-anomaly.h"
-#include "output-json-flow.h"
-#include "output-json-netflow.h"
+#include "output/eve/output-json.h"
+#include "output/eve/output-json-alert.h"
+#include "output/eve/output-json-anomaly.h"
+#include "output/eve/output-json-flow.h"
+#include "output/eve/output-json-netflow.h"
 #include "log-cf-common.h"
-#include "output-json-drop.h"
-#include "output-eve-stream.h"
+#include "output/eve/output-json-drop.h"
+#include "output/eve/output-eve-stream.h"
 #include "app-layer/http/log-httplog.h"
 #include "app-layer/http/logger.h"
 #include "app-layer/dns/logger.h"
@@ -60,9 +60,9 @@
 #include "app-layer/tls/logger.h"
 #include "app-layer/ssh/logger.h"
 #include "log-pcap.h"
-#include "output-json-file.h"
+#include "output/eve/output-json-file.h"
 #include "app-layer/smtp/logger.h"
-#include "output-json-stats.h"
+#include "output/eve/output-json-stats.h"
 #include "log-tcp-data.h"
 #include "log-stats.h"
 #include "app-layer/nfs/logger.h"
@@ -83,13 +83,13 @@
 #include "app-layer/template/logger.h"
 #include "app-layer/rdp/logger.h"
 #include "app-layer/http2/logger.h"
-#include "output-lua.h"
+#include "output/output-lua.h"
 #include "app-layer/dnp3/logger.h"
-#include "output-json-metadata.h"
+#include "output/eve/output-json-metadata.h"
 #include "app-layer/dcerpc/logger.h"
-#include "output-json-frame.h"
+#include "output/eve/output-json-frame.h"
 #include "app-layer/bittorrent-dht/logger.h"
-#include "output-filestore.h"
+#include "output/output-filestore.h"
 
 typedef struct RootLogger_ {
     OutputLogFunc LogFunc;
diff --git a/src/output.h b/src/output/output.h
similarity index 97%
rename from src/output.h
rename to src/output/output.h
index d1e1dbf49c69..e4f06a20d91c 100644
--- a/src/output.h
+++ b/src/output/output.h
@@ -35,13 +35,13 @@ typedef struct OutputLoggerThreadStore_ {
     struct OutputLoggerThreadStore_ *next;
 } OutputLoggerThreadStore;
 
-#include "output-packet.h"
-#include "output-tx.h"
-#include "output-file.h"
-#include "output-filedata.h"
-#include "output-flow.h"
-#include "output-streaming.h"
-#include "output-stats.h"
+#include "output/output-packet.h"
+#include "output/output-tx.h"
+#include "output/output-file.h"
+#include "output/output-filedata.h"
+#include "output/output-flow.h"
+#include "output/output-streaming.h"
+#include "output/output-stats.h"
 
 typedef struct OutputInitResult_ {
     OutputCtx *ctx;
diff --git a/src/runmode-af-packet.c b/src/runmode-af-packet.c
index b742d556f18f..91d3fa2b9970 100644
--- a/src/runmode-af-packet.c
+++ b/src/runmode-af-packet.c
@@ -36,7 +36,7 @@
 #include "conf.h"
 #include "runmodes.h"
 #include "runmode-af-packet.h"
-#include "output.h"
+#include "output/output.h"
 #include "app-layer/http/log-httplog.h"
 #include "detect-engine-mpm.h"
 
diff --git a/src/runmode-af-xdp.c b/src/runmode-af-xdp.c
index d829b7b39d41..9b705c44d72b 100644
--- a/src/runmode-af-xdp.c
+++ b/src/runmode-af-xdp.c
@@ -36,7 +36,7 @@
 #include "conf.h"
 #include "runmodes.h"
 #include "runmode-af-xdp.h"
-#include "output.h"
+#include "output/output.h"
 #include "app-layer/http/log-httplog.h"
 #include "detect-engine-mpm.h"
 
diff --git a/src/runmode-erf-dag.c b/src/runmode-erf-dag.c
index 7a7313b0e0fe..9ab12518841d 100644
--- a/src/runmode-erf-dag.c
+++ b/src/runmode-erf-dag.c
@@ -20,7 +20,7 @@
 #include "conf.h"
 #include "runmodes.h"
 #include "runmode-erf-dag.h"
-#include "output.h"
+#include "output/output.h"
 
 #include "detect-engine.h"
 
diff --git a/src/runmode-erf-file.c b/src/runmode-erf-file.c
index d85bb343c35a..88cfba5d7a5e 100644
--- a/src/runmode-erf-file.c
+++ b/src/runmode-erf-file.c
@@ -20,7 +20,7 @@
 #include "conf.h"
 #include "runmodes.h"
 #include "runmode-erf-file.h"
-#include "output.h"
+#include "output/output.h"
 
 #include "detect-engine.h"
 
diff --git a/src/runmode-ipfw.c b/src/runmode-ipfw.c
index ca61aed35b1f..52c362edcdb1 100644
--- a/src/runmode-ipfw.c
+++ b/src/runmode-ipfw.c
@@ -29,7 +29,7 @@
 #include "conf.h"
 #include "runmodes.h"
 #include "runmode-ipfw.h"
-#include "output.h"
+#include "output/output.h"
 
 #include "util-debug.h"
 #include "util-time.h"
diff --git a/src/runmode-napatech.c b/src/runmode-napatech.c
index d59212f2a80c..816d09105085 100644
--- a/src/runmode-napatech.c
+++ b/src/runmode-napatech.c
@@ -26,7 +26,7 @@
 #include "tm-threads.h"
 #include "conf.h"
 #include "runmodes.h"
-#include "output.h"
+#include "output/output.h"
 #include "util-debug.h"
 #include "util-time.h"
 #include "util-cpu.h"
diff --git a/src/runmode-nfq.c b/src/runmode-nfq.c
index ff4ce8fa0814..90652676eab0 100644
--- a/src/runmode-nfq.c
+++ b/src/runmode-nfq.c
@@ -29,7 +29,7 @@
 #include "conf.h"
 #include "runmodes.h"
 #include "runmode-nfq.h"
-#include "output.h"
+#include "output/output.h"
 
 #include "util-debug.h"
 #include "util-time.h"
diff --git a/src/runmode-pcap-file.c b/src/runmode-pcap-file.c
index a24dd3865e47..1bade48dd2c0 100644
--- a/src/runmode-pcap-file.c
+++ b/src/runmode-pcap-file.c
@@ -20,7 +20,7 @@
 #include "conf.h"
 #include "runmodes.h"
 #include "runmode-pcap-file.h"
-#include "output.h"
+#include "output/output.h"
 
 #include "detect-engine.h"
 #include "source-pcap-file.h"
diff --git a/src/runmode-pcap.c b/src/runmode-pcap.c
index 5d4892d76f05..68263112c465 100644
--- a/src/runmode-pcap.c
+++ b/src/runmode-pcap.c
@@ -18,7 +18,7 @@
 #include "suricata-common.h"
 #include "runmode-pcap.h"
 #include "runmodes.h"
-#include "output.h"
+#include "output/output.h"
 
 #include "util-conf.h"
 #include "util-debug.h"
diff --git a/src/runmode-unix-socket.c b/src/runmode-unix-socket.c
index f90f481df228..fc92e7a6cdc0 100644
--- a/src/runmode-unix-socket.c
+++ b/src/runmode-unix-socket.c
@@ -20,8 +20,8 @@
 #include "conf.h"
 #include "runmodes.h"
 #include "runmode-pcap-file.h"
-#include "output.h"
-#include "output-json.h"
+#include "output/output.h"
+#include "output/eve/output-json.h"
 
 #include "util-debug.h"
 #include "util-time.h"
diff --git a/src/runmode-windivert.c b/src/runmode-windivert.c
index 0d604440bc2d..d86cdac97ac6 100644
--- a/src/runmode-windivert.c
+++ b/src/runmode-windivert.c
@@ -28,7 +28,7 @@
 #include "conf.h"
 #include "runmodes.h"
 #include "runmode-windivert.h"
-#include "output.h"
+#include "output/output.h"
 
 #include "util-affinity.h"
 #include "util-cpu.h"
diff --git a/src/runmodes.c b/src/runmodes.c
index e3d900f37ebc..d6cbec176bd3 100644
--- a/src/runmodes.c
+++ b/src/runmodes.c
@@ -55,7 +55,7 @@
 #include "util-misc.h"
 #include "util-plugin.h"
 
-#include "output.h"
+#include "output/output.h"
 
 #include "alert-fastlog.h"
 #include "alert-debuglog.h"
diff --git a/src/suricata.c b/src/suricata.c
index 28597f819227..ee31ddde4eb2 100644
--- a/src/suricata.c
+++ b/src/suricata.c
@@ -80,8 +80,8 @@
 #include "app-layer/http/parser.h"
 #include "app-layer/http/parser-range.h"
 
-#include "output.h"
-#include "output-filestore.h"
+#include "output/output.h"
+#include "output/output-filestore.h"
 
 #include "respond-reject.h"
 
diff --git a/src/unix-manager.c b/src/unix-manager.c
index 4da9f3f6d2bb..6937142152a0 100644
--- a/src/unix-manager.c
+++ b/src/unix-manager.c
@@ -30,7 +30,7 @@
 #include "conf.h"
 #include "runmode-unix-socket.h"
 
-#include "output-json-stats.h"
+#include "output/eve/output-json-stats.h"
 
 #include "util-conf.h"
 #include "util-privs.h"
@@ -48,8 +48,8 @@
 #include <sys/stat.h>
 #include <sys/types.h>
 
-#include "output.h"
-#include "output-json.h"
+#include "output/output.h"
+#include "output/eve/output-json.h"
 
 // MSG_NOSIGNAL does not exists on OS X
 #ifdef OS_DARWIN
diff --git a/src/util-debug.c b/src/util-debug.c
index b764416dd0f7..6ea5f6bba17e 100644
--- a/src/util-debug.c
+++ b/src/util-debug.c
@@ -26,7 +26,7 @@
 #include "suricata-common.h"
 #include "util-debug.h"
 
-#include "output.h"
+#include "output/output.h"
 
 #include "suricata.h"
 
diff --git a/src/util-logopenfile.c b/src/util-logopenfile.c
index 0d488ab89ebc..e1a7a5df3003 100644
--- a/src/util-logopenfile.c
+++ b/src/util-logopenfile.c
@@ -27,7 +27,7 @@
 #include "util-logopenfile.h"
 #include "suricata.h"
 #include "conf.h"   /* ConfNode, etc. */
-#include "output.h" /* DEFAULT_LOG_* */
+#include "output/output.h" /* DEFAULT_LOG_* */
 #include "util-byte.h"
 #include "util-conf.h"
 #include "util-path.h"
diff --git a/src/util-lua-common.c b/src/util-lua-common.c
index 8d586016a966..d2391da063cf 100644
--- a/src/util-lua-common.c
+++ b/src/util-lua-common.c
@@ -37,7 +37,7 @@
 
 #include "util-debug.h"
 
-#include "output.h"
+#include "output/output.h"
 #include "app-layer/http/parser.h"
 #include "app-layer.h"
 #include "app-layer-parser.h"
diff --git a/src/util-lua-ja3.c b/src/util-lua-ja3.c
index 346b96ef0151..eef3cb9ab48d 100644
--- a/src/util-lua-ja3.c
+++ b/src/util-lua-ja3.c
@@ -36,7 +36,7 @@
 
 #include "util-debug.h"
 
-#include "output.h"
+#include "output/output.h"
 #include "app-layer.h"
 #include "app-layer-parser.h"
 #include "app-layer/ssl/parser.h"
diff --git a/src/util-lua.c b/src/util-lua.c
index af031ac799c3..250e3ace9718 100644
--- a/src/util-lua.c
+++ b/src/util-lua.c
@@ -38,7 +38,7 @@
 
 #include "util-debug.h"
 
-#include "output.h"
+#include "output/output.h"
 #include "app-layer/http/parser.h"
 #include "app-layer.h"
 #include "app-layer-parser.h"
diff --git a/src/util-plugin.c b/src/util-plugin.c
index 87fed319d43e..8a37105947de 100644
--- a/src/util-plugin.c
+++ b/src/util-plugin.c
@@ -19,7 +19,7 @@
 #include "suricata-plugin.h"
 #include "suricata.h"
 #include "runmodes.h"
-#include "output-eve-syslog.h"
+#include "output/eve/output-eve-syslog.h"
 #include "util-plugin.h"
 #include "util-debug.h"
 
diff --git a/src/util-runmodes.c b/src/util-runmodes.c
index ca672d2100b3..1bc9fe16f839 100644
--- a/src/util-runmodes.c
+++ b/src/util-runmodes.c
@@ -29,7 +29,7 @@
 #include "conf.h"
 #include "runmodes.h"
 #include "runmode-af-packet.h"
-#include "output.h"
+#include "output/output.h"
 #include "app-layer/http/log-httplog.h"
 
 #include "detect-engine.h"