doc: documentation update on metadata

diff --git a/doc/userguide/output/eve/eve-json-output.rst b/doc/userguide/output/eve/eve-json-output.rst
index 8574d7c44e6c8bb849c5d182ddb7ec75aef43290..936027ee8ed61f651abdbf37301074acec4f4d75 100644 (file)
--- a/doc/userguide/output/eve/eve-json-output.rst
+++ b/doc/userguide/output/eve/eve-json-output.rst
@@ -76,6 +76,18 @@ layer metadata to output on a per application layer basis ::
 The `vars` will enable dumping of a set of key/value based on flowbits and other vars
 such as named groups in regular expression.
 
+It is also possible to log key/value pairs defined by the metadata keyword on rule. To
+do so you need to set `enabled` to yes under `rule-metadata` ::
+
+        - alert:
+            metadata: yes              # add L7/applayer fields, flowbit and other vars to the alert
+            rule-metadata:             # dumping of key/value pairs defined by metadata keyword of rule
+              enabled: yes              # set to yes to enable
+              output-array: no         # output value of key as an array
+              array-keys: [tag]        # comma separated array of keys to output as array
+
+This will add a `alert.metadata` object in the alert event.
+
 DNS
 ~~~
 

diff --git a/doc/userguide/partials/eve-log.yaml b/doc/userguide/partials/eve-log.yaml
index ee6436cf979768683dece59a4e1edf75231c4701..98e4e8bf8b5f5d48cf32fb79c970114255a5e4dc 100644 (file)
--- a/doc/userguide/partials/eve-log.yaml
+++ b/doc/userguide/partials/eve-log.yaml
@@ -54,6 +54,11 @@ outputs:
             # "tag" keyword.
             tagged-packets: yes
 
+            rule-metadata:             # dumping of key/value pairs defined by metadata keyword of rule
+              enabled: no              # set to yes to enable
+              output-array: no         # output value of key as an array
+              array-keys: [tag]        # comma separated array of keys to output as array
+
             # HTTP X-Forwarded-For support by adding an extra field or overwriting
             # the source or destination IP address (depending on flow direction)
             # with the one reported in the X-Forwarded-For HTTP header. This is

diff --git a/doc/userguide/rules/meta.rst b/doc/userguide/rules/meta.rst
index bdcf733ea6665f57972f8aead8468d23ea9f34dc..27be92b2db53b913418387d32e305bf36fcd7cff 100644 (file)
--- a/doc/userguide/rules/meta.rst
+++ b/doc/userguide/rules/meta.rst
@@ -168,10 +168,14 @@ format of priority is::
 
 metadata
 --------
-Suricata ignores the words behind meta data.  Suricata supports this
-keyword because it is part of the signature language.  The format is::
 
-  metadata:......;
+The meatadata keyword allows additional, non-functional information to
+be added to the signature. While the format is free-form, it is
+recommended to stick to key, value pairs as Suricata can include these
+in eve alerts. The format is::
+
+  metadata: key value;
+  metadata: key value, key value;
 
 target
 ------