Chapter 4 Advanced Expressions: Evaluating Text 93
• delete_all
• insert_before_all
For example, you might want to delete all instances of "http://exampleurl.com/"
and "http://exampleurl.au/" in the first 1000 bytes of the body. To do this, you can
configure a rewrite action to search for all instances of the string "exampleurl,"
extend the scope of the search on both sides of the string when a match is found,
and then use a regular expression to perform the rewrite in the extended region.
The following example extends the scope of the search by 20 bytes to the left and
50 bytes to the right of the matching string:
add rewrite action delurl_example delete_all 'HTTP.REQ.
BODY(1000)' -pattern exampleurl -refineSearch 'extend(20,50).
regex_select(re#http://exampleurl.(com|au)#)'
Converting Text to Hexadecimal Format
The following operator converts text to hexadecimal format and extracts the
resulting string:
text.BLOB_TO_HEX("string")
For example, this operator converts the byte string “abc” to “61:62:63”.