Hacker News Reader

Log forwarding to a single server running rsyslogd, and then view consolidated logs there.

I’ve personally used Graylog[1] with success in the past. However, I’ve had an excellent time with Grafana and have been following their Loki[2] project. My company uses other solutions, so I haven’t needed it, but the Grafana stack might suit your use case.

[1] https://www.graylog.org/products/open-source [2] https://grafana.com/docs/loki/latest/

The question was: "What would be a step up [from ssh] without a lot of extra infrastructure?"

I think you just way overshot it.

My attempt at a simple step up would be mounting the logs with sshfs and using your favorite editor.

Run vector [1] on each host to collect logs and send them to New Relic's free tier.

No need to manage extra infrastructure for logging, New Relic works pretty well and also has alerts, and Vector makes it easy to move to a new provider or self-hosted solution without reinstalling agents: just add a new sink to your config file.

[1] https://github.com/vectordotdev/vector

New Relic has a free tier, just install their agent (or another compatible logging agent).