0

This question already has an answer here:

Have inputs.conf files in multiple directories that needs to match and parse each stanza and modify the existing index name into index=secure_np and index=secure_pr. Also i run the script to locate the inputs file in each directory and modify the index but getting no such file or directory. Two examples of DIR which has inputs file in it (_GWAS_pr_linux_t1/local/inputs.conf)/ (_GWAS_np_linux_t1/local/inputs.conf).

I try this, I am expecting this script to modify any exiting index name containing np to index=secure_np in inputs.conf files in any DIR but should not modify or have any impact with any exiting index name containing pr in inputs.conf in any DIR.

i) perl -00lpe '$_.=.*np$"secure_np" if m,/(monitor:///var/log/(?:messages|cron|maillog|secure|audit/audit\.log|maillog)\],' *linux*/local/inputs.conf  

[monitor:///var/log/messages]
index=BDBD9D3KMKM_np
sourcetype=syslog

[monitor:///var/log/cron]
index=NDNWCM_np
sourcetype=syslog

[monitor:///var/log/maillog]
index=BSKXB3B_np
sourcetype=syslog

[monitor:///var/log/secure]
index=NDNDKDK0M_np
sourcetype=syslog

[monitor:///var/log/spooler]
index=DNWNDNK8N_np
sourcetype=syslog

[monitor:///var/log/audit/audit.log]
index=XBJBBDHJ_np
sourcetype=syslog

I try this, I am expecting this script to modify any exiting index name containing pr to index=secure_pr in inputs.conf files in any DIR but should not modify or have any impact with any exiting index name containing np in inputs.conf files in any DIR.

ii) perl -00lpe '$_.=.*pr$"secure_pr" if m,/(monitor:///var/log/(?:messages|cron|maillog|secure|audit/audit\.log|maillog)\],' *linux*/local/inputs.conf


[monitor:///var/log/messages]
index=JNJSJ_pr
sourcetype=syslog

[monitor:///var/log/cron]
index=NCJNLN_pr
sourcetype=syslog

[monitor:///var/log/maillog]
index=JE3KKK_pr
sourcetype=syslog

[monitor:///var/log/secure]
index=NLNDKNWL_pr
sourcetype=syslog

[monitor:///var/log/spooler]
index=EKJCDE6D_pr
sourcetype=syslog

[monitor:///var/log/audit/audit.log]
index=QKNKQN9SA_pr 
sourcetype=syslog

marked as duplicate by Jeff Schaller Jul 3 at 16:30

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    It's not really clear what you want to achieve. Please provide more details (better with examples like before / after). Would be nice also to show what you tried and what doesn't work for you exactly. – rush Jun 5 at 21:54
  • Have update that with examples – user10965163 Jun 6 at 0:33
  • The script could`t modify the index name to secure_pr and secure_np – user10965163 Jun 9 at 16:20