Transformation keyword can't trigger an alert

Rules
3

Thanks for your reply. I update with Suricata 6.0.1 and I run the following two tests. But it seems like the problem has not been sovled.

  1. Test 1

I use a rule file containing 2 rules:

alert http any any -> $HOME_NET any (msg:“detect (/etc/passwd)”; flow:to_server,established; http.request_body; url_decode; content:"/etc/passwd"; nocase; sid:1001;)
alert http any any -> $HOME_NET any (msg:“detect (/etc/passwd)”; flow:to_server,established; http.request_body; url_decode; content:"/etc/passwd"; nocase; sid:1002;)

And I get 2 alerts .

  1. Test 2

I use a rule file containing 2 rules:
alert http any any -> $HOME_NET any (msg:“detect (/etc/passwd)”; flow:to_server,established; http.request_body;content:"/etc/passwd"; nocase; sid:1001;)
alert http any any -> $HOME_NET any (msg:“detect (/etc/passwd)”; flow:to_server,established; http.request_body; url_decode; content:"/etc/passwd"; nocase; sid:1002;)

And I get no alert .

The test pcap file is attached here.
http.pcap (2.0 KB)