Suricata 7.0.8 config about pcap-log

You can try by using the tag feature, see 8.51. Tag — Suricata 8.0.0-dev documentation