Hi!
I’m not sure if there are other things to be fixed as well but I’m looking at the first two rules and I see that you use http.method which is a content modifier and not a sticky buffer. So, you should probably put it after the content.
https://suricata.readthedocs.io/en/latest/rules/http-keywords.html#http-method
Will be happy to try it out if you can provide the pcap.