Hi, upstream improved the log rotation [0] and that may help in running suricata under a different user than root. Please, keep an eye at the upcoming upstream releases uploaded to debian to check if this is true.
I will do some tests in my side too when the release happens. regards. [0] https://redmine.openinfosecfoundation.org/issues/1938
