Forum Discussion
Michael_Yates
Oct 14, 2011Nimbostratus
Hi jvuong004,
Try moving the STREAM::expression to the HTTP_RESPONSE event since a stream profile replaces things on the response and inside of your STREAM_MATCHED, execute the replacement for each of your stream expressions.
when HTTP_RESPONSE {
STREAM::expression ":foo:: :bar::"
STREAM::enable
}
when STREAM_MATCHED {
log local0. "Stream filter matched: [STREAM::match]"
STREAM::replace "[string map {"foo" "I replaced foo" "bar" "I replaced bar"} [STREAM::match]]"
}
Hope this helps.