About text expressions

Last published : Sep 22, 2026
You can configure various expressions for working with text that flows through the NetScaler appliance. Following are some examples of how you can parse text by using a Advanced policy expression:
  • Determine that a particular HTTP header exists.
    For example, you may want to identify HTTP requests that contains a particular Accept-Language header for the purpose of directing the request to a particular server.
  • Determine that a particular HTTP URL contains a particular string.
    For example, you may want to block requests for particular URLs. Note that the string can occur at the beginning, middle, or end of another string.
  • Identify a POST request that is directed to a particular application.
    For example, you may want to identify all POST requests that are directed to a database application for the purpose of refreshing cached application data.
Note that there are specialized tools for viewing the data stream for HTTP requests and responses. You can use the tools to view the data stream.

About operations on text

A text-based expression consists of at least one prefix to identify an element of data and usually (although not always) an operation on that prefix. Text-based operations can apply to any part of a request or a response. Basic operations on text include various types of string matches.
For example, the following expression compares a header value with a string:
http.req.header("myHeader").contains("some-text")
Following expressions are examples of matching a file type in a request:
http.req.url.suffix.contains("jpeg")
http.req.url.suffix.eq("jpeg")
In the preceding examples, the contains operator permits a partial match and the eq operator looks for an exact match.
Other operations are available to format the string before evaluating it. For example, you can use text operations to strip out quotes and white spaces, to convert the string to all lowercase, or to concatenate strings.
Note:
Complex operations are available to perform matching based on patterns or to convert one type of text format to another type.
For more information, see the following topics:

Compounding and precedence in text expressions

You can apply various operators to combine text prefixes or expressions. For example, the following expression concatenates the returned values of each prefix:
http.req.hostname + http.req.url
Following is an example of a compound text expression that uses a logical AND. Both components of this expression must be TRUE for a request to match the expression:
http.req.method.eq(post) && http.req.body(1024).startswith("destination=")
Note:
For more information on operators for compounding, see Compound advanced expressions.

Categories of text expressions

The primary categories of text expressions that you can configure are:
Note:
Parsing a document body, such as the body of a POST request, can affect performance. You may want to test the performance impact of policies that evaluate a document body.

Guidelines for text expressions

From a performance standpoint, it typically is best to use protocol-aware functions in an expression. For example, the following expression makes use of a protocol-aware function:
HTTP.REQ.URL.QUERY
The previous expression performs better than the following equivalent expression, which is based on string parsing:
HTTP.REQ.URL.AFTER_STR("?")
In the first case, the expression looks specifically at the URL query. In the second case, the expression scans the data for the first occurrence of a question mark.
There is also a performance benefit from structured parsing of text, as in the following expression:
HTTP.REQ.HEADER("Example").TYPECAST_LIST_T(',').GET(1)
(For more information on typecasting, see Typecasting data. The typecasting expression, which collects comma-delimited data and structures it into a list, typically would perform better than the following unstructured equivalent:
HTTP.REQ.HEADER("Example").AFTER_STR(",").BEFORE_STR(",")
Finally, unstructured text expressions typically have better performance than regular expressions. For example, the following is an unstructured text expression:
HTTP.REQ.HEADER("Example").AFTER_STR("more")
The previous expression would generally provide better performance than the following equivalent, which uses a regular expression:
HTTP.REQ.HEADER("Example").AFTER_REGEX(re/more/)
For more information on regular expressions, see Regular expressions.