diff --git a/src/opnsense/service/templates/OPNsense/IDS/suricata.yaml b/src/opnsense/service/templates/OPNsense/IDS/suricata.yaml
index 4d1a06b61..66f251b88 100644
--- a/src/opnsense/service/templates/OPNsense/IDS/suricata.yaml
+++ b/src/opnsense/service/templates/OPNsense/IDS/suricata.yaml
@@ -226,7 +226,7 @@ outputs:
 
   # a line based alerts log similar to fast.log into syslog
   - syslog:
-      enabled: {% if OPNsense.IDS.general.syslog|default('0') == '0' %}no{% else %}yes{% endif %}
+      enabled: {% if helpers.exists('OPNsense.IDS.general.syslog') and OPNsense.IDS.general.syslog|default('0') == '0' %}no{% else %}yes{% endif %}
       # reported identity to syslog. If ommited the program name (usually
       # suricata) will be used.
       #identity: "suricata"
@@ -740,7 +740,7 @@ logging:
       enabled: yes
       filename: /var/log/suricata.log
   - syslog:
-      enabled: {% if OPNsense.IDS.general.syslog|default('0') == '0' %}no{% else %}yes{% endif %}
+      enabled: {% if helpers.exists('OPNsense.IDS.general.syslog') and OPNsense.IDS.general.syslog|default('0') == '0' %}no{% else %}yes{% endif %}
 
       facility: local5
       format: "[%i] <%d> -- "