diff --git a/doc/userguide/rules/meta.rst b/doc/userguide/rules/meta.rst index 9149b11a86..62820fd878 100644 --- a/doc/userguide/rules/meta.rst +++ b/doc/userguide/rules/meta.rst @@ -156,9 +156,9 @@ expressed in the signature. The format of priority is:: metadata -------- -The metadata keyword allows additional, non-functional information to +The metadata keyword allows additional, non-functional, information to be added to the signature. While the format is free-form, it is -recommended to stick to key, value pairs as Suricata can include these +recommended to stick to `[key, value]` pairs as Suricata can include these in eve alerts. The format is:: metadata: key value;