Hi Vladimir,
STREAM is designed to modify TCP::payload on a stream of "just enough" segments, to find and replace payload data.
This behavior may break the Content-Length mechanic of HTTP requests, if you're going to change the total length of the HTTP payload.
F5 added changes to STREAM / HTTP profile combination, so that classic Content-Length mechanic (length is included in the header) will be turned into a chunked "Transfer-Encoding" mechanic (length is included in each chunk), to support the STREAM'ing on "just enough" HTTP chunks for find and replace operations. In the case that chunked payload gets changed and resulting in a different chunk size, the length field of the currently processed chunk gets adjusted...
But yeah... you only want to log and not adjust anything, isn't it?
AFAIK did F5 not implemented a setting to explicitly turn off this behavior for STREAM / HTTP traffic. But you may clarify this with F5 Support to get sure...
If the behavior can't be turned off, then you may add a 3rd VS-Layer in your chain to STREAM process certain URIs.
VS_FronEnd -> VS_STREAM -> VS_APM (for specific request)
VS_FrontEnd -> VS_APM (for remaining Traffic)
The VS_STREAM will only get a TCP and STREAM Profile assigned, but not a HTTP Profile. Setup your expressions during CLIENT_ACCEPTED and then do some fancy stuff on STREAM_MATCHED events. But keep in mind to not change anything... just analyse the TCP stream and log your expressions...
Cheers, Kai