Looking for pointers in the right direction on what to use - scan/regexpx/Stream Profiles

when CLIENT_ACCEPTED {
     log local0. "Entity ID parsing irule - collecting tcp payload"
     TCP::collect 400
}
when CLIENT_DATA {
   set clientip [IP::client_addr]
   log local0. "TCP payload collected for $cl
   switch -glob [TCP::payload]  {
   "UserID" 
      set entity_id [findstr [TCP::payload] UserID ,]
}
     persist uie $entity_id 1800
 }
}