Suricata

Add a list mode that uses the redis RPUSH command instead of LPUSH. Let's call it "rlist"

Why?
When using redis output in "list" mode the LPUSH command is used. This adds the event at the head of the list. If on the other end a logstash instance is consuming those events it is doing a (B)LPOP. This means it takes an event from the head of the list. Pushing and popping from the head can lead to a situation in which events stuck at the tail/end of the list until logstash was able to empty the list completely.