Stream::Replace Will Not Work

Hi jvuong004,

Try moving the STREAM::expression to the HTTP_RESPONSE event since a stream profile replaces things on the response and inside of your STREAM_MATCHED, execute the replacement for each of your stream expressions.

 
when HTTP_RESPONSE {
STREAM::expression ":foo:: :bar::"
STREAM::enable 
}
when STREAM_MATCHED {
log local0. "Stream filter matched: [STREAM::match]"
STREAM::replace "[string map {"foo" "I replaced foo" "bar" "I replaced bar"} [STREAM::match]]"
}

Hope this helps.