There will often be a hop in there anyways because you may want to bounce/forward to many locations: ELK, SIEM, offsite, etc. I would argue you want your first

There will often be a hop in there anyways because you may want to bounce/forward to many locations: ELK, SIEM, offsite, etc. I would argue you want your first hop to be the simplest (IMHO, rsyslogd saving to text files, which can be easily rsync'd or zfs-send/recv).