Suricata

Passthorugh may be a good idea sometimes like dns.query; pcrexform:"\.([^\.]+\.[^\.]+)$"; to extract the top domain if it is a subdomain or just passthrough if it is not a subdomain

passthrough on error is necessary to maintain pre-filter semantics.

Jeff Lucovsky wrote in #note-8:

passthrough on error is necessary to maintain pre-filter semantics.

I do not understand what this means. Could you expand on it ?
What are pre-filter semantics ?

The transform output is used during pre-filtering. Maintaining the buffer on transform error allows that prefiltering to continue to operate as before so that the remainder of the rule can be evaluated.

You are just stating that this feature is a breaking change, or am I missing something ?

(And I think it is a good breaking change)

Yes -- it'd be a breaking change.
I discussed this with @Victor Julien and we decided to leave the buffer unmodified for transform errors.

Rereading my comment https://redmine.openinfosecfoundation.org/issues/7313#note-1 I understand this, thanks :-)