Forum Discussion
hooleylist
Aug 20, 2007Cirrostratus
I was able to get regexes to work by wrapping the stream expression in {}'s:
This example looks for IP addresses in response content and replaces them with 0.0.0.0:
when HTTP_RESPONSE {
STREAM::enable
STREAM::expression {@\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}@0.0.0.0@}
}
Backreferences didn't seem to work though... the matched string is replaced with a literal \1.
Aaron