Your issue doesn’t seem to perfectly match the problem I had, but I think this deserves to be mentioned: Fast.log isn't updated when Suricata is running
It’s just about the feature you want. 
And it exactly what that can produce a strange behavior if you don’t put buffer-size: 0 in the fast: section; at least for testing purpose.