Zagidi has asked for the wisdom of the Perl Monks concerning the following question:
Trying to change all of the indexes ending in _pr (or _np) to linux_pr (or linux_np)
Monitor blocks in inputs.conf is limited to messages, secure, cron, maillog, spooler, audit, audit.log
Have other files in inputs.conf i do not want to change the indexes.
code isn`t working it changes all the indexes to linux instead of linux_pr (or linux_np)
perl -00pe 's#^\[monitor:///var/log/(?:messages|secure|cron|maillog|sp +ooler|audit/audit\.log)\]\n.*^index\s*=\s*\k.+(?=_(?:np|pr)\s*$)#linu +x#ms' inputs.conf _DATA_ [monitor:///var/log/cron] index=NDNW_np sourcetype=syslog [monitor:///var/log/maillog] index=BSKX_np sourcetype=syslog [monitor:///var/log/secure] index=NDNDK_np sourcetype=syslog [monitor:///var/log/spooler] index=DNWN_np sourcetype=syslog [monitor:///var/log/audit/audit.log] index=XBJB_np sourcetype=syslog [monitor:///var/log/messages] index=JNJSJ_pr sourcetype=syslog [monitor:///var/log/cron] index=NCJG_pr sourcetype=syslog [monitor:///var/log/maillog] index=JE3K_pr sourcetype=syslog [monitor:///var/log/secure] index=NLNDKN_pr sourcetype=syslog [monitor:///var/log/spooler] index=EKJC_pr sourcetype=syslog [monitor:///var/log/audit/audit.log] index=QKNK_pr sourcetype=syslog
Back to
Seekers of Perl Wisdom