Do you see the URI being updated in the request made to the server? The value for HTTP::uri is cached in the same event (and same priority) so you wouldn't see it log statements in the HTTP_REQUEST event.
Else, can you try with some debug logging:
when HTTP_REQUEST {
log local0. "[IP::client_addr]:[TCP::client_port]: Original URI: [HTTP::uri]"
switch -glob [HTTP::path] {
"/sir/*" {
HTTP::uri [string map {"/sir/" "/"} [HTTP::uri]]
pool L7-ETE-AMSI-REDIRECT
}
default {
pool l7-ETE-AMSI
}
}
}
when HTTP_REQUEST priority 501 {
log local0. "[IP::client_addr]:[TCP::client_port]: Current URI: [HTTP::uri]"
}
Aaron