One of the primary concerns is being able to get the data ("out" of the firewall) into a data engine for event correlation. One of many examples would be Splunk. Currently, Barnyard2 provides syslog capability that enables simplified separation of the event streams (ability to prescribe specific facility and destination for output separate from the firewall's syslog and without having to clog the firewall's logs with IDS/IPS logging data). Sounds like the upcoming changes could become a step backwards if it makes it more difficult to get the data out of the firewall, despite improvements in logging format, no?
In reviewing the Suricata documentation a bit more, it appears to offer the ability to tailor output (directly?) to syslog - including the ability to modify the output format as to match a required SEIM input format.
FWIW - have been involved in the administration of a couple firewalls over many years that are on FreeBSD (currently 12.0-p10), using PF with Snort, Barnyard2, etc. and those utilize the PostgreSQL output plugin - which has been available from the FreeBSD ports for many years. Somewhat surprised that the output plugin wasn't included for Barnyard2 in PFSense, while MySQL was included.
Including a small perl script that may be helpful to sort suppress lists, as these can often be a quagmire to wade through when looking to manage via the file itself as they can become quite huge and being able to see suppressed items in a logical order makes it a bit easier.
sort-suppress.pl.gz