# Suricata Sending Request & Response Bodies in multiple events due to alert rule
**URL:** https://forum.suricata.io/t/suricata-sending-request-response-bodies-in-multiple-events-due-to-alert-rule/4455
**Category:** Rules
**Tags:** rules, suricata
**Created:** [February 1, 2024, 11:20am UTC](https://forum.suricata.io/t/suricata-sending-request-response-bodies-in-multiple-events-due-to-alert-rule/4455 "2024-02-01T11:20:37Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Saurabh\_Yelmame](https://forum.suricata.io/u/Saurabh_Yelmame)
#### Post date: [February 1, 2024, 11:20am UTC](https://forum.suricata.io/t/suricata-sending-request-response-bodies-in-multiple-events-due-to-alert-rule/4455/1 "2024-02-01T11:20:37Z")
Hi all, I was using Suricata for monitoring traffic, I have a rule - **alert http any any → any any (msg: “HTTP traffic detected-request”; sid:200002; rev:1;)** And my configuration(suricata.yaml) file looks like -
outputs:
```
- eve-log:
enabled: yes
filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
filename: eve-reg.json
# include the name of the input pcap file in pcap file processing mode
pcap-file: false
# enable/disable the community id feature.
community-id: false
# Seed value for the ID output. Valid values are 0-65535.
community-id-seed: 0
xff:
enabled: no
types:
- alert:
payload: yes # enable dumping payload in Base64
payload-buffer-size: 128kb # max size of payload buffer to output in eve-log
payload-printable: no # enable dumping payload in printable (lossy) format
metadata: yes # enable inclusion of app layer metadata with alert. Default yes
http-body: yes # Requires metadata; enable dumping of HTTP body in Base64
http-body-printable: no # Requires metadata; enable dumping of HTTP body in printable format
# Enable the logging of tagged packets for rules using the
# "tag" keyword.
tagged-packets: yes
- http:
extended: yes # enable this for extended logging information
dump-all-headers: both
- http2:
extended: yes # enable this for extended logging information
dump-all-headers: both
```
For one single traffic(request to the server) containing request body around 70kb, I am getting roughly around 100 events which contain the request body in chunks, I am getting the headers in one single event in eve reg - (event\_type: http) By any chance is it possible that I get the complete body in one single event.
---
### Author:  [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)
#### Post date: [February 28, 2024, 8:24pm UTC](https://forum.suricata.io/t/suricata-sending-request-response-bodies-in-multiple-events-due-to-alert-rule/4455/2 "2024-02-28T20:24:06Z")
> [@Saurabh\_Yelmame](#):
>
> `payload-buffer-size: 128kb`
Did you try to increase that value?
---
### Author:  [@Saurabh\_Yelmame](https://forum.suricata.io/u/Saurabh_Yelmame)
#### Post date: [March 7, 2024, 10:13am UTC](https://forum.suricata.io/t/suricata-sending-request-response-bodies-in-multiple-events-due-to-alert-rule/4455/3 "2024-03-07T10:13:36Z")
No, I didnt try,
My concern actually is -
Is there any way I can configure suricata such that it will accumulate all the request bodies and response bodies and send to me in one event
---
### Author:  [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)
#### Post date: [April 25, 2024, 8:09pm UTC](https://forum.suricata.io/t/suricata-sending-request-response-bodies-in-multiple-events-due-to-alert-rule/4455/4 "2024-04-25T20:09:28Z")
Do you have an example pcap, so we could try to reproduce it?