You are approaching this the wrong way. A far better approach is to use a capture engine like Daemonlogger and then post-process the data in near real time.
The reason is that, as wonderful as Snort is, the more you add the the ruleset, the slower it will operate. Don't get me wrong, it's very good, but this is not an ideal way to configure it. If you are dealing with high speed well utilized links, Snort may begin to drop packets.
Marty Roesch, created of Snort, wrote Daemonlogger to address exactly this issue. Daemonlogger is used for fast full packet capture, which is then analyzed by one or more Snort instances (or other tools like SANCP, Silk, etc.)
Rather than starting from scratch I'd suggest that you look into SecurityOnion, which has all of this stuff already installed and ready to use, or look at NSMWiki.org, which has great general information and lots of specific information on Sguil, which is an excellent NSM architecture and interface.