华为云服务器：139.2.6.102

ELK服务器：10.0.0.120

KVM服务器：123.123.123.123

数据流：

一、配置华为云上的rsyslog（Huawei Cloud EulerOS release 2.0）

[root@huawei ~]# vi /etc/rsyslog.conf
#在文件最后添加
# Send login log to ap server
*.* @@123.123.123.123:514
[root@huawei ~]# systemctl restart rsyslog

二、配置KVM服务器（CentOS 7)

1、rsyslog

[root@kvm ~]# vi /etc/rsyslog.conf
#使用tcp端口，把以下两行的注释去掉：
module(load="imtcp") # needs to be done just once
input(type="imtcp" port="514")
#在#### RULES ####前添加模板：
$template RemoteHost,"/var/log/remote_system_%HOSTNAME%.log"
#在# ### sample forwarding rule ###前加上：
:fromhost-ip, isequal, "139.2.6.102" ?RemoteHost
#匹配ip为139.2.6.102的日志保存到/var/log/remote_system_huawei.log。模板中“%HOSTNAME%”自动替换为服务器名。

2、安装filebeat

[root@kvm ~]# rpm -ivh https://mirrors.tuna.tsinghua.edu.cn/elasticstack/8.x/yum/8.8.0/filebeat-8.8.0-x86_64.rpm
[root@kvm ~]# vi /etc/filebeat/filebeat.yml
paths:
#- /var/log/remote_system_huawei.log
- /var/log/*.log

setup.kibana:

# Kibana Host
# Scheme and port can be left out and will be set to the default (http and 5601)
# In case you specify and additional path, the scheme is required: http://localhost:5601/path
# IPv6 addresses should always be defined as: https://[2001:db8::1]:5601
host: "10.0.0.120:5601"

# ---------------------------- Elasticsearch Output ----------------------------
output.elasticsearch:
# Array of hosts to connect to.
hosts: ["10.0.0.120:9200"]

# Protocol - either `http` (default) or `https`.
protocol: "https"

# Authentication credentials - either API key or username/password.
#api_key: "id:api_key"
username: "elastic"
password: "zwU1A=4h3hx3dDgtfyrK"
ssl.certificate_authorities: ["/root/http_ca.crt"]
[root@kvm ~]# systemctl start filebeat

3、NAT 10.0.0.120:5601

[root@kvm ~]# firewall-cmd --add-forward -port=port=5601:proto=tcp:toport=5601:toaddr=10.0.0.120 --permanent
[root@kvm ~]# firewall-cmd --reload

三、配置ELK服务器（Ubuntu 22.10)

root@elk:~#  apt -y update

root@elk:~# apt install -y wget openjdk-8-jdk 

root@elk:~# wget https://mirrors.tuna.tsinghua.edu.cn/elasticstack/8.x/apt/pool/main/e/elasticsearch/elasticsearch-8.8.2-amd64.deb

dpkg -i elasticsearch-8.8.2-amd64.deb

systemctl daemon-reload

systemctl start elasticsearch

wget https://mirrors.tuna.tsinghua.edu.cn/elasticstack/8.x/apt/pool/main/k/kibana/kibana-8.8.2-amd64.deb

dpkg -i kibana-8.8.2-amd64.deb

安装过程需要用elasticsearch生成token，请参考官方文档：

https://www.elastic.co/guide/en/kibana/8.8/deb.html

最后分享一下ssh loging的日志分析