How to collect and record the original traffic data in flow

Help
1

hello, when I use suricata, I found that the collected flow event data will not output the original data packet to the log by default. I would like to ask how to make the original data packet, especially tcp traffic, be stored in the event.

If anyone knows how to configure, please let me know. Thank you.

2

You can print the payload within the alert events, you can also use pcap logging to have the pcaps available as well. The full packet in the flow event would be quite a lot.