Yes. You can use both the second and third rule.
However, for accurate detection, the third rule is appropriate.
content:"GET"; content:"blog"; Identifies requests to the server with the path “blog”, but can lead to detectable problems if other values include blog.
For example,
GET / HTTP/1.1
Host: blog.server.com
...
Requests such as the above can also be detected.
The third rule is content:"GET"; http_mehtod; content:"blog"; http_uri; indicates that the value blog exists only in the URI. In other words, it does not detect that the “blog” string occurs anywhere other than the URI.
If you want to detect that the path is blog, host must be included. If the server host is server.com, it should be curl server.com/blog.