suricata - Threshold.config syntax different from snort syntax