Suricata

As far as i can see not all the possible HTTP header fields and values are beeing collected and put into the eve-format output (JSON). This would mean that analysts are missing out on potentialy important data when looking at HTTP logs from Suricta. The fields that are stored are documented in EveJSONFormat, but as a found out today more than these are possibly stored (saw X-Forwarded-For values stored under the name "xff"). So if it is the case that all fieldnames and values are stored, sorry for my lack of doublechecking before posting this issue, if not all observed field/values are stored, this would be a good thing to implement.

P.s. I think i might have seen a similar issue but i could not find it, so sorry if this is a duplicate entry.