perl -00pe 's#^\[monitor:///var/log/(?:messages|secure|cron|maillog|spooler|audit/audit\.log)\]\n.*^index\s*=\s*\k.+(?=_(?:np|pr)\s*$)#linux#ms' inputs.conf

_DATA_
[monitor:///var/log/cron]
index=NDNW_np
sourcetype=syslog
...