Suricata

alert http any any -> any any (http.uri; content:"down"; flowbits:set,uritest; sid:11;)
alert http any any -> any any (http.user_agent; content:"Mozilla"; flowbits:isset, headtest; flowbits:set,moz; sid:10;)
alert http any any -> any any (http.method; content:"GET"; flowbits:isset,uritest; flowbits:set,headtest; sid:12;)
alert http any any -> any any (http.host; content:"ether"; flowbits:isset,moz; sid:14;)

should be ordered: 11, 12, 10, 14. Is actually ordered: 11, 10, 12, 14. This is because in the ordering there just 3 cases:
set, read, read_set. Sid 10 and 12 are both read_set, and thus correct order isn't enforced.