URI substitution

The results for these HTTP:: commands are cached in the same event and event priority:

HTTP::password

HTTP::username

HTTP::host

HTTP::path

HTTP::query

HTTP::request_num

HTTP::status

HTTP::uri

HTTP::is_keepalive

HTTP::is_redirect

HTTP::request

In v11, this caching was fixed so that if one of the request components was updated the cached value would be updated too. I assume you're testing on v10 so you'll still see the cached value. If you want to verify the rewrite is being done as expected, you can use a later HTTP_REQUEST priority:

when HTTP_REQUEST priority 501 {

    This event runs after the HTTP_REQUEST event with a default priority of 500
   log local0. "Updated \[HTTP::path\]: [HTTP::path]"
}

Aaron