Suricata Filestore - logging HTTP nonstop

[michmoor]

I have filestore working but it seems to be logging HTTP/SMB only where as the eve.json log selection doesn't include HTTP.
This is after a few Suricata restarts.
It just really wants to log HTTP for some reason. @bmeeks Any idea?

[bmeeks]

Those are two independent things: File Store versus EVE JSON http logging. File Store captures all file transfers where appropriate flow bits are set by rules. EVE JSON logging is about capturing the packet metadata and payload (when enabled).

So, turning off HTTP logging in the EVE JSON logging options should remove logging of HTTP packet metadata, but that will not stop File Store activity related to HTTP. To the best of my recollection that is triggered by the rules you have enabled for file capture and the corresponding flowbits they may set.