Unable to output logs (vxlan)

I am running Suricata on AWS.
One of the devices is doing SSL decryption and I want to visualize the communication with Suricata. However, I can’t get it to work.
We are using the VPC traffic mirroring feature of AWS.
We are using the AWS VPC traffic mirroring function. ・We are using vxlan (port 4789) to communicate to Suricata.

The rules I have described are as follows
alert udp any any → any any (msg: “Google”; content: “www.google.com”; http_header; sid:2001; rev:1;)
alert udp any any → any any (msg: “Connect”; content: “CONNECT”; http_method; sid:2002; rev:1;)
alert udp any any → any any (msg: “UDP traffic detected”; sid:2000; rev:1;)
I want to output the first line of the log, but only the last log is output. (I am trying to access Google)
08/27/2021-10:05:12.682577 [] [1:2000:1] UDP traffic detected [] [Classification: (null)] [Priority: 3] {UDP} → 10.200.1. 10:4789

I am trying to get header info, methods, etc.
What am I doing wrong?

Thank you.

Note that http is sent over TCP and your rules are limited to UDP.

Thank you very much for your help. I was able to solve the problem.