Parsing Traffic by URI

Do you see the URI being updated in the request made to the server? The value for HTTP::uri is cached in the same event (and same priority) so you wouldn't see it log statements in the HTTP_REQUEST event.

Else, can you try with some debug logging:

 
  when HTTP_REQUEST {  
  
     log local0. "[IP::client_addr]:[TCP::client_port]: Original URI: [HTTP::uri]" 
  
     switch -glob [HTTP::path] {  
        "/sir/*" {  
           HTTP::uri [string map {"/sir/" "/"} [HTTP::uri]]  
   pool L7-ETE-AMSI-REDIRECT  
        }  
        default {  
           pool l7-ETE-AMSI  
        }  
     }  
  }  
  when HTTP_REQUEST priority 501 { 
     log local0. "[IP::client_addr]:[TCP::client_port]: Current URI: [HTTP::uri]" 
  } 
 

Aaron