That won't work, because you have to collect the payload before you can acesss it (through the HTTP_REQUEST_DATA event)... Your example was a little confusing, so I may not have understood your logic too well. But try something like this (you'll need to modify it if you're wanting to use a datagroup instead of static payload values):
Collect a request payload
when HTTP_REQUEST {
if {[HTTP::method] eq "POST"}{
Trigger collection for up to 1MB of data
if {[HTTP::header "Content-Length"] ne "" && [HTTP::header "Content-Length"] <= 1048576}{
set content_length [HTTP::header "Content-Length"]
} else {
set content_length 1048576
}
Check if $content_length is not set to 0
if { $content_length > 0} {
HTTP::collect $content_length
}
}
}
when HTTP_REQUEST_DATA {
do stuff with the payload
set payload [HTTP::payload]
if { [HTTP::payload] contains "register" } {
if { [HTTP::payload] contains "Location" && [IP::addr [IP::client_addr] equals "1.1.1.1/24"] } {
log local0. "Using uri-match pool - [HTTP::uri]"
pool $defaultpool
return
} else {
log local0. "No uri matched using no-uri-match pool - [HTTP::uri]"
drop
return
}
}
if { not ([string tolower [HTTP::uri]] contains "register") } { pool $defaultpool }
}