Suricata

Emerging threats and Positive technologies are now using metadata to store additional high level info in the signatures. Following usage describe in Snort documentation and already implemented in sourcefire ruleset, they are using a key [value without comma] format.

This provides really interesting information to the analyst and he would benefit of being able to use it in search on the storage backend.

Suricata could provide that by storing the metadata as a dictionary under the alert subobject.