When we were looking at endpoint stuff, we really wanted to handle offline machines. So logshipping felt like a good match. Thus filebeat/logstash, fluent; or syslog with local buffers. But maybe the kafka output also handles that