STREAM iRule question

STREAM_MATCHED is typically called when a) you want more flexibility that a STREAM::expression will give you, and b) you're not also replacing the data in the STREAM::expression. Example:

when SERVER_DATA {
    STREAM::expression {@this@@ @that@@ @something@@}
    TCP::release
}
when STREAM_MATCHED {
    if { some logic for STREAM::matched } {
        STREAM::replace "the data that you'd otherwise put in the replace part of the delimited STREAM::expression"
    }
}

Plus, if you put the STREAM::disable in the STREAM_MATCHED event, it'll replace the first thing it sees and then turn itself off for the rest of the TCP connection. I'd probably move the STREAM::disable to the SERVER_CONNECTED event (unless this is intentionally what you want it to do).