Rewriting uri

Sorry, I thought you wanted to strip out the uid parameter and its value if set. I reread your first post and think you want to move uid and its value to the front of the query string and then prepend hxs=1. Here is an example which avoids regexes. Maybe someone has a more efficient method?

  
  when RULE_INIT {  
    
      Set a couple of test query strings  
     set source {a=123&k=456&uid=toto&h=789}  
     set source {uid=toto&a=123&k=456&h=789}  
     set source {a=123&k=456&h=789&uid=toto}  
    
      Split the string into a list on the delimiter &  
     log local0. "\[split \$source\ &]: [split $source &]"  
    
      Create a new query string  
     set new_query_string ""  
    
      Loop through the list and create a new string of parameters and values 
     foreach param_value_pair [split $source &] {  
    
        log local0. "\$param_value_pair: $param_value_pair"  
    
         If the current param value pair starts with uid=, then prepend it to the list of query string parameters  
        if {$param_value_pair starts_with "uid="}{  
           set new_query_string ${param_value_pair}${new_query_string}  
        } else {  
           set new_query_string ${new_query_string}&${param_value_pair}  
        }  
        log local0. "\$new_query_string: $new_query_string"  
     }  
     set new_query_string hxs=1&${new_query_string}  
    
     log local0. "\$new_query_string: $new_query_string"  
    
  }  
  

Log output:

Rule : [split $source &]: a=123 k=456 h=789 uid=toto

Rule : $param_value_pair: a=123

Rule : $new_query_string: &a=123

Rule : $param_value_pair: k=456

Rule : $new_query_string: &a=123&k=456

Rule : $param_value_pair: h=789

Rule : $new_query_string: &a=123&k=456&h=789

Rule : $param_value_pair: uid=toto

Rule : $new_query_string: uid=toto&a=123&k=456&h=789

Rule : $new_query_string: hxs=1&uid=toto&a=123&k=456&h=789

You'd want to add a check to see that the URI contains uid= before using this logic.

Aaron