Why is my string replacement not performed using rsyslog?

Question

rsyslogd 8.24

Im trying to perform a string replacement for this log:

This is the $msg received:

[malware3] IN=ens192 OUT=ens192 MAC=00:50:56:...