idea.yaml

outputs:
  - eve-log:
      types:
        - alert:
            metadata: yes
            
            # Include context from the rule that triggered the alert.
            # Defaults:
            #   - raw: false
            #   - metadata: true
            #   - references: false
            rule:
              raw: false
              metadata: true
              references: false
              
            # This would log references and metadata, as metadata is true by default.
            rule:
              references: true
              
            # This would only log the raw rule.
            rule:
              raw: true
              metadata: false

maybe-extra-data-is-a-better-word-than-metadata.yaml

outputs:
  - eve-log:
      types:
        - alert:
            extra-data:
              app-layer: true
              flow: true
              rule:
                raw: false
                metadata: true
                references: false

more-metadata.yaml

outputs:
  - eve-log:
      types:
        - alert:
            metadata:
              app-layer: true
              flow: true
              rule:
                raw: false
                metadata: true
                references: false