使用 sed 替换捕获组内容的正则表达式

Question

在需要匹配和解析每个节并将 index= 修改为 index=secure 的多个目录中有 inputs.conf 文件。 这是inputs.conf中的文件类型，并且运行脚本以在此目录（_GWAS_pr_linux_t1/local/inputs.conf）中找到输入文件以修改索引

[monitor:///var/log/messages]
index=BDBD_np
sourcetype=syslog

[monitor:///var/log/cron]
index=NDNW_np
sourcetype=syslog

[monitor:///var/log/maillog]
index=BSKX_np
sourcetype=syslog

[monitor:///var/log/secure]
index=NDNDK_np
sourcetype=syslog

[monitor:///var/log/spooler]
index=DNWN_np
sourcetype=syslog

[monitor:///var/log/audit/audit.log]
index=XBJB_np
sourcetype=syslog


    sed -i -e 's/.*(?s)((\[monitor\:\/\/\/var\/log\/messages|secure\]).*?)(?:(?:\r*\n){2})' /index=secure *linux*/local/inputs.conf

############################
match each stanza and modify index name to index=windows
inputs file in this dir (_GWAS_pr_window_t1/local/inputs.conf)


    [WinEventLog://Application]
    checkpointInterval = 5
    current_only = 0
    disabled =0 
    start_from = oldest
    index = 

    [WinEventLog://Security]
    checkpointInterval = 5
    current_only = 0
    disabled =0 
    start_from = oldest
    index = 

    [WinEventLog://System]
    checkpointInterval = 5
    current_only = 0
    disabled =0 
    start_from = oldest
    index = 

    [WinEventLog://ForwardedEvents]
    checkpointInterval = 5
    current_only = 0
    disabled =0 
    start_from = oldest
    index = 

    [WinEventLog://Setup]
    checkpointInterval = 5
    current_only = 0
    disabled =0 
    start_from = oldest
    index = 

    sed -i -e 's/.*(?s)((\[WinEventLog:\/\/Application|Security|System|ForwardedEvents|Setup\]).*?)(?:(?:\r\n){2}) /index=window *window*/local/inputs.conf

Answer 1

您可以使用带有-0 mode 的perl，而不是使用逐行读取的sed。例如，您可以在第 1 组中捕获此部分：

[monitor:///var/log/messages]
sourcetype=linux
index=

随后匹配power。

然后在替换中，您可以引用组 1 并添加安全 $1secure 以便替换匹配的电源。

(\[monitor:///var/log/(?:messages|secure)\](?:(?:\R.*){2})index=)power

Regex demo

perl -0p -i.bak -e 's#(\[monitor:///var/log/(?:messages|secure)\](?:(?:\R.*){2})index=)power#$1secure#g' inputs.conf

结果：

[monitor:///var/log/messages]
sourcetype=linux
index=secure

更新

如果您想匹配 cmets 中列出的任何单词并将其替换为 index 之后的单词，您可以使用 2 个捕获组：

perl -0p -i.bak -e 's#(\[monitor:///var/log/(messages|secure|cron|spooler|audit\.log)\](?:(?:\R.*){2})index=).*#$1$2#g' inputs.conf

图案

(\[monitor:///var/log/(messages|secure|cron|spooler|audit\.log)\](?:(?:\R.*){2})index=).*

Regex demo

结果：

[monitor:///var/log/messages]
  sourcetype=linux
index=messages

[monitor:///var/log/secure]
  sourcetype=linux
index=secure

Answer 2

这可能对你有用（GNU sed）：

sed -E '/^\[/{h;b};G;s/^(index=)power\n.*(messages|secure)\]$/\1secure/;P;d' file

这会将每个节的第一行附加到每一行并使用模式匹配，将power 替换为secure。