stream find/replace expression with an exclude

Hi Nik,

You can check what the matched string was using STREAM::match in the STREAM_MATCHED event. However, if you set your STREAM::expression match to "a string" STREAM::match is only going to return 'a string' and you won't know the context of it. You could use a regex to match more of the string. Can you provide a more exact sample of what you do/don't want to match in the content?

Here's an example of customizing the replacement in STREAM_MATCHED:

 From http://devcentral.f5.com/wiki/default.aspx/iRules/stream__expression
when HTTP_REQUEST {
    Disable the stream filter for all requests
   STREAM::disable
}
when HTTP_RESPONSE {  
    Check if response type is text  
   if {[HTTP::header value Content-Type] contains "text"}{  
       Match an http://*example.com string and replace it with nothing yet
      STREAM::expression {&http://.*?example\.com&&}
       Enable the stream filter for this response only  
      STREAM::enable  
   }  
}   
when STREAM_MATCHED {  
    Check if the matched string meets some condition
   if {[STREAM::match] starts_with "host1"}{
       Replace http:// with https:// and do the replacement
      STREAM::replace "[string map {http:// https://} [STREAM::match]]"
      log local0. "[IP::client_addr]:[TCP::local_port]: matched: [STREAM::match], replaced with: [string map {http:// https://} [STREAM::match]]"  
   }
}

Aaron