Trying to change all of the indexes ending in _pr (or _np) to linux_pr (or linux_np)
Monitor blocks in inputs.conf is limited to messages, secure, cron, maillog, spooler, audit, audit.log
Have other files in inputs.conf i do not want to change the indexes.
code isn`t working it changes all the indexes to linux instead of linux_pr (or linux_np)
perl -00pe 's#^\[monitor:///var/log/(?:messages|secure|cron|maillog|sp
+ooler|audit/audit\.log)\]\n.*^index\s*=\s*\k.+(?=_(?:np|pr)\s*$)#linu
+x#ms' inputs.conf
_DATA_
[monitor:///var/log/cron]
index=NDNW_np
sourcetype=syslog
[monitor:///var/log/maillog]
index=BSKX_np
sourcetype=syslog
[monitor:///var/log/secure]
index=NDNDK_np
sourcetype=syslog
[monitor:///var/log/spooler]
index=DNWN_np
sourcetype=syslog
[monitor:///var/log/audit/audit.log]
index=XBJB_np
sourcetype=syslog
[monitor:///var/log/messages]
index=JNJSJ_pr
sourcetype=syslog
[monitor:///var/log/cron]
index=NCJG_pr
sourcetype=syslog
[monitor:///var/log/maillog]
index=JE3K_pr
sourcetype=syslog
[monitor:///var/log/secure]
index=NLNDKN_pr
sourcetype=syslog
[monitor:///var/log/spooler]
index=EKJC_pr
sourcetype=syslog
[monitor:///var/log/audit/audit.log]
index=QKNK_pr
sourcetype=syslog