Why suricata don't generate filehash for alerts

Try enabling filestore version 2 in the yaml configuration.
I would also try setting the stream-depth: 0 option under the files-store key in the yaml configuration.
It would be interesting to see the yaml for the alert, it should say if the file was truncated or not.