[akdev1l]

afaik journald can just forward logs via rsyslog directly to a remote server

Why would it need to store plaintext locally?

[mrweasel]

Doesn't that still involve a conversion? I believe that rsyslog can read the journald database, but you're typically not querying syslog data directly, so there's a conversion between rsyslog and logstash, Splunk, Datalog, whatever.

[NewJazz]

Some folks like having some local storage to act as a buffer in case the remote syslog server is down. Not sure if journald can do that on its own.