Forum Discussion
It looks like you've taken the script at https://devcentral.f5.com/codeshare?sid=741 and then removed the two patterns that are used to identify where the new content should be inserted.
The important lines in that script are:
append stream_repl $static::jscript
append stream_expression "@$stream_find@$stream_find$stream_repl@"
append stream_expression "@$stream_find_lower@$stream_find_lower$stream_repl@"
STREAM::expression $stream_expression
This builds up a string containing "@pattern1@replacement1@pattern2@replacement2@", which tells it to find pattern1 and replace it with replacement1, and also find pattern2, and replace it with repalacement2.
In the original script, pattern1 was $stream_find, which has a value of "". pattern2 was $stream_find_lower, with a value of "". The purpose of this was to locate the "" of the document, and replace it with "somereplacementvalue". It repeated this for the lower case,
With your modifications:
set stream_find ""
set stream_find_lower ""
set stream_repl ""
The script is now looking for nothing, and trying to replace it. It doesn't find nothing, so this never matches. This can be trivially demonstrated as below:
rule stream_test:
when HTTP_RESPONSE {
replace nothing with 'something'
STREAM::expression "@@something@"
}
when STREAM_MATCHED {
log local0. "[IP::client_addr]:[TCP::local_port]: matched: [STREAM::match]"
}
If I apply that rule to a virtual server, and request a document, the document remains unchanged:
curl http://172.16.218.100/test.html
HTML Document
This is an HTML document
If I then modify the rule to replace the word 'Document' with the word 'Elephant', and request the same page, we see that the word Document is changed to Elephant (and 'document', with a lower case L is not changed).
STREAM::expression "@Document@Elephant@"
curl http://172.16.218.100/test.html
HTML Elephant
This is an HTML document
In addition, the log statement in the STREAM_MATCHED event also shows us in /var/log/ltm that the match was successful
May 12 01:14:55 ltm-1200-211 info tmm1[8886]: Rule /Common/stream_test : 172.16.218.211:50937: matched: Document
So in short, it's not matching because you can't match an empty string.