confused by match_regx

Yes, it should match as a pipe is considered a logical OR in regex. Here's a simple test to show the match:

when RULE_INIT {

    http://sjj-cache28.dddstatic.com/resources/flex/ticketFilter-1.10.2.swf 
   set host sjj-cache28.dddstatic.com
   set uri "/resources/flex/ticketFilter-1.10.2.swf"
   set subdomain1 "static" 
   set subdomain2 "s"
   if { $host matches_regex "^$subdomain1.|$subdomain2." and ($uri matches_regex "(jpg|bmp|gif|png|img|ico|js|css|swf|swz|vbs|html|htm|csv|txt|crossdomain.xml)$")} {
   if { $uri matches_regex "^/(cswebtool|cobrands|jsrs|overflow|promotions|data|resources)" }{
         log local0. "matched"
         return
      }
   }
   log local0. "no match"
}

< RULE_INIT >: matched

However, it would be a lot more efficient to replace the regexes with string commands:

when HTTP_REQUEST {

   switch -glob [string tolower [HTTP::host]] {
      "s.*" -
      "static.*" {
         switch -glob [HTTP::path] {
            "*.jpg" -
            "*.bmp" -
            "*.gif" -
            "*.png" -
            "*.img" -
            "*.ico" -
            "*.js" -
            "*.css" -
            "*.swf" -
            "*.swz" -
            "*.vbs" -
            "*.html" -
            "*.htm" -
            "*.csv" -
            "*.txt" -
            "*.crossdomain.xml" {
               switch -glob [HTTP::path] {
                  "/cswebtool*" -
                  "/cobrands*" -
                  "/jsrs*" -
                  "/overflow*" -
                  "/promotions*" -
                  "/data*" -
                  "/resources*" {
                     persist none
                     pool SRWD25-STATIC
                     return
                  }
       }
            }
         }
      }
   }
}

Aaron