Suricata

I'm trying to store only files with a .pdf extension using a Suricata rule. However, I've noticed that when a single HTTP transaction contains multiple files (e.g., both .pdf and other types like .txt or .jpg), all files are stored—even those that don’t have a .pdf extension.

Here’s the rule I’m using:
alert http any any -> any any (content:"POST"; http_method; flow:to_server; fileext:"pdf"; filestore; sid:111; rev:1; classtype:file_store; flowbits:noalert;)

A pcap file is attached. Is this expected in my Suricata version, or could it be a bug? I’m using Suricata v6.0.6.