From 0d155932585a76e16b6da89e3f9f10009b0cd796 Mon Sep 17 00:00:00 2001
From: Victor Julien <victor@inliniac.net>
Date: Mon, 3 Oct 2016 18:02:07 +0200
Subject: [PATCH] doc: move urilen to other uri keywords

---
 doc/userguide/rules/http-keywords.rst | 58 +++++++++++++--------------
 1 file changed, 29 insertions(+), 29 deletions(-)

diff --git a/doc/userguide/rules/http-keywords.rst b/doc/userguide/rules/http-keywords.rst
index 388cbdd6f9..c032ab3a7c 100644
--- a/doc/userguide/rules/http-keywords.rst
+++ b/doc/userguide/rules/http-keywords.rst
@@ -143,6 +143,35 @@ When authoring new rules, it is recommended that the ``http_uri``
 content modifier be used rather than the deprecated ``uricontent``
 keyword.
 
+urilen
+------
+
+The ``urilen`` keyword is used to match on the length of the request
+URI. It is possible to use the ``<`` and ``>`` operators, which
+indicate respectively *smaller than* and *larger than*.
+
+The format of ``urilen`` is::
+
+  urilen:3;
+
+Other possibilities are::
+
+  urilen:1;
+  urilen:>1;
+  urilen:<10;
+  urilen:10<>20;	(bigger than 10, smaller than 20)
+
+Example:
+
+.. image:: http-keywords/urilen.png
+
+Example of ``urilen`` in a signature:
+
+.. image:: http-keywords/urilen1.png
+
+You can also append ``norm`` or ``raw`` to define what sort of buffer you want
+to use (normalized or raw buffer).
+
 http_request_line
 -----------------
 
@@ -340,35 +369,6 @@ in your :ref:`libhtp configuration section
 <suricata-yaml-configure-libhtp>` via the ``response-body-limit``
 setting.
 
-urilen
-------
-
-The ``urilen`` keyword is used to match on the length of the request
-URI. It is possible to use the ``<`` and ``>`` operators, which
-indicate respectively *smaller than* and *larger than*.
-
-The format of ``urilen`` is::
-
-  urilen:3;
-
-Other possibilities are::
-
-  urilen:1;
-  urilen:>1;
-  urilen:<10;
-  urilen:10<>20;	(bigger than 10, smaller than 20)
-
-Example:
-
-.. image:: http-keywords/urilen.png
-
-Example of ``urilen`` in a signature:
-
-.. image:: http-keywords/urilen1.png
-
-You can also append ``norm`` or ``raw`` to define what sort of buffer you want
-to use (normalized or raw buffer).
-
 pcre
 ----