Stream::expression irule problem

That looks about right. The regex doesn't match top.jpg:

% regexp

wrong args: should be "regexp ?switches? exp string ?matchVar? ?subMatchVar subMatchVar ...?"

% regexp -inline -all {top\.(?!jpg)} top.test

top.

% regexp -inline -all {top\.(?!jpg)} top.jpg

%

Is it possible that jpg is in mixed case? If so, you could use character classes to avoid matching:

regexp -inline -all {top\.(?![jJ][pP][gG])}

Else, you could do more extensive checks of the match by setting the replacement string in STREAM_MATCHED using STREAM::replace. There is an example of this in the last sample of the STREAM::expression wiki page:

 
  http://devcentral.f5.com/wiki/default.aspx/iRules/stream__expression 
 when HTTP_RESPONSE {   
     
     Disable the stream filter by default   
    STREAM::disable   
     
     Check if response type is text   
    if {[HTTP::header value Content-Type] contains "text"}{   
     
        Match any http:// instance and replace it with nothing  
       STREAM::expression {&http://.*?example\.com&&} 
     
        Enable the stream filter for this response only   
       STREAM::enable   
    }   
 }    
 when STREAM_MATCHED {   
    log local0. "[IP::client_addr]:[TCP::local_port]: matched: [STREAM::match],\ 
       replaced with: [string map {http:// https://} [STREAM::match]]"   
    STREAM::replace "[string map {http:// https://} [STREAM::match]]"   
 } 
 

Aaron