I tired to set response-body-limit and memcap for http protocol from suricata.yaml. It is strange that if I set them to a smaller integer (for instance, 10), in eve.json it truncates more in eve.json as "http_response_body_printable\":\"...... ..\",\"http_response_body\":\"AAABAAEAICAAAA==\", as expected. But if I set them to a greater number, the truncate continues without improvement. ![]()