File store of suricata

Hello there, would you please take a look where the problems could be? Thanks.
The suricata version is 6.0.3.
i tried to enable the file-store in Suricata, expecting a PDF file stored in the folder ‘filestore’ , but got a lot of empty sub-folders like follows:

My suricata settings are as below:


The pcap file is:
pdf_http_467659.pcap (12.3 KB)

The directories with 2-character names are intentional.

If you want to locate the files, get the SHA from the log entry in eve.json, the first 2 characters of the SHA will indicate which directory contains the extracted file.

Or, you can use find

cd /path/to/where/files/are/extracted
find . -type f