Why suricata don't generate filehash for alerts

Tried this , libnss was already there . didn’t work
Checked flow , it contained a sha1 but it was not of that file.