Suricata

I am not sure I understand.
Which yaml are we talking about ? test.yaml ?
Can we have the example where it works and where it fails with an inner field missing ?

This is somewhat by design.. If you have a match block like:

alert:
  action: allowed
  severity: 3
  signature: msg escape tests
  signature_id: 100

You are looking for equality on the whole object. If you just want to look for one value, you can use:

alert.action: allowed

Jason Ish wrote in #note-4:

This is somewhat by design.. If you have a match block like:
[...]

You are looking for equality on the whole object. If you just want to look for one value, you can use:
[...]

Oh. Thanks, Jason!