They are both reliable and they both have Elasticsearch outputs (recipe for rsyslog+Elasticsearch+Kibana here: http://blog.sematext.com/2013/07/01/recipe-rsyslo

They are both reliable and they both have Elasticsearch outputs (recipe for rsyslog+Elasticsearch+Kibana here: http://blog.sematext.com/2013/07/01/recipe-rsyslog-elasticsearch-kibana/ http://blog.sematext.com/2013/07/01/recipe-rsyslog-elasticse...). I would stick with rsyslog if you only need to send syslog to Elasticsearch (maybe upgrade to a recent version, the ones from most distros are ancient). Logstash is more flexible and easy to use, so if I have something that rsyslog can't do or it's too messy, I would replace it with Logstash, or just install Logstash alongside rsyslog (normally, rsyslog is very light)