journalctl -o json is a log pipeline with no agent

The journal already stores structured records with a unit, a priority and a hostname; the text output is a rendering rather than the data.

$ journalctl -u php7.4-fpm -o json --since '10 min ago' 
  | jq -r 'select(.PRIORITY|tonumber <= 3) | .MESSAGE'

$ journalctl -o json -f | your-shipper

# the cursor field is what makes it resumable:
#   __CURSOR — record it after each batch

Following the journal in JSON and piping it to a shipper is a complete log pipeline with no agent to install, which is enough for a small estate and removes a moving part. The cursor is what turns a restart into a resume rather than a re-ship of the whole day. Setting SystemMaxUse deliberately matters here as much as anywhere, because the default is a percentage of the disk.