Filemd5 and filestore keywords

I want to save file by file md5,rules like this:
alert http any any -> any any (msg:“Black list”; filemd5:blackfilemd5; filestore; sid:111111115; rev:1;)
blackfilemd5 like this
微信截图_20200528092545
then I download the file which md5 is 80e5815c89ed461228e8a38b6cba1ab0
but there is no alert match the rule in eve.json.
there is a fileinfo in eve.json and sid is empty and state is truncated,stored is false.
why the rule not match? and how to save all download file no matter rule is match?
I need other config?

Without more details about your setup, configuration etc. its hard to tell. Ideally you can provide a pcap to reproduce the issue.

I want to store all file,so configuration:
5114

I find two question by eve.log
one:small file can be store,but big file is truncated.
two:force-hash is md5,but eve.log have md5 and sha256,when file is truncated md5 is disappear
like this:


stream-depth is 0,why big file is truncated?and md5 is disappear?
Thank you

How big is the file in the truncated case?
How do you capture the traffic and how does the rest of the config look like?