Suricata

If global(main yaml) vlan tracking is disabled

vlan:
  use-for-tracking: false

then the loading sequence should not allow "vlan" as a selector in the multi-detect section of yaml.

multi-detect:
  enabled: yes
  #selector: direct # direct or vlan
  selector: vlan