# When Suricata 7.0.10 outputs alert logs in eve.json, how can one know which part of the packet's keyword was matched by the rule?

**URL:** https://forum.suricata.io/t/when-suricata-7-0-10-outputs-alert-logs-in-eve-json-how-can-one-know-which-part-of-the-packets-keyword-was-matched-by-the-rule/5652
**Category:** Uncategorized
**Created:** [April 27, 2025, 3:34am UTC](https://forum.suricata.io/t/when-suricata-7-0-10-outputs-alert-logs-in-eve-json-how-can-one-know-which-part-of-the-packets-keyword-was-matched-by-the-rule/5652 "2025-04-27T03:34:14Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Edison\_Chen](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/edison_chen/32/3508_2.png) [@Edison\_Chen](https://forum.suricata.io/u/Edison_Chen)
#### Post date: [April 27, 2025, 3:34am UTC](https://forum.suricata.io/t/when-suricata-7-0-10-outputs-alert-logs-in-eve-json-how-can-one-know-which-part-of-the-packets-keyword-was-matched-by-the-rule/5652/1 "2025-04-27T03:34:14Z")

</div>

When Suricata 7.0.9 outputs alert logs in eve.json, how can one know which part of the packet’s keyword was matched by the rule?

---

<div class="post-metadata">

### Author: ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)
#### Post date: [July 17, 2025, 9:03pm UTC](https://forum.suricata.io/t/when-suricata-7-0-10-outputs-alert-logs-in-eve-json-how-can-one-know-which-part-of-the-packets-keyword-was-matched-by-the-rule/5652/2 "2025-07-17T21:03:20Z")

</div>

It just shows the `signature_id` in the `event_type` for alert. What part specifically matched is not shown.