Suricata

Suricata version: 8.0.7

Description:

When Suricata runs in unix-socket mode (--unix-socket) and processes PCAP via the
pcap-file command, alerts in eve.json don't include rule metadata (alert.metadata),
even though it's enabled in the eve-log alert output:

- alert:
        metadata:
          app-layer: yes
          flow: no
          rule:
            metadata: yes

The other metadata settings in the same block are honored (app-layer data is logged
and flow is not), so the configuration is being read.

Steps to reproduce:

1. Start Suricata with --unix-socket and the alert config above.
2. Submit a PCAP that triggers ET Open rules (which all carry metadata) with
pcap-file.
3. eve.json alerts have no alert.metadata.

Observations:

- The same config and PCAP with r (no unix socket) produce alert.metadata as
expected.
reload-rules immediately after startup, before any pcap-file run, does not help:
the next PCAP still produces alerts without alert.metadata.
- reload-rules after the instance has completed at least one pcap-file run does:
every subsequent PCAP produces alerts with alert.metadata.

This suggests rule metadata is only built for rules parsed after the alert output
has been initialized for a pcap-file run, and in unix-socket mode that doesn't
happen until the first run, after the initial ruleset (and any reload before that
run) has already been parsed.

Workaround:

After an instance starts, submit a minimal one-packet PCAP with pcap-file, wait
for it to finish (pcap-current returns "None" and pcap-file-number returns 0),
then reload-rules. Alerts from all later runs include alert.metadata.

Expected behavior:

Rule metadata is included in alert output from the first pcap-file run, as it is
with -r.