no documentation for file-store-waldo
suricata.yaml.in includes a "waldo" line, but that seems to be ignored unless there is a "file-store-waldo: yes" line elsewhere in suricata.yaml. As far as I can tell, there is no documentation at all for file-store-waldo. It would be good both to include it in suricata.yaml.in as well as to mention in the existing waldo line that it needs to be enabled elsewhere.
Alternatively, if this isn't the intended behavior, the file-store-waldo logic in src/output-filedata.c should be changed.