Hí,
Take a good look at the quotes, they are different.
alert http any any -> any any (msg:"DiariodeCadiz.es HTTP Host";flow: to_server,established;content:"Diario de"; http_header;sid:15;rev:1;)
alert ip 192.168.1.188 any -> $HOME_NET any (msg:”Test IP rules”; sid:2900000; rev:1;)
If you put the correct quotes…
suri@xxxx:~/tmp/pruebas$ cat fast.log
04/13/2022-10:54:23.497578 [**] [1:2900000:1] Test IP rules [**] [Classification: (null)] [Priority: 3] {TCP} 192.168.1.181:22 -> 192.168.1.188:60750