journalctl –output=json and a log pipeline for free

The journal already stores structured records with unit, priority, hostname and timestamps; the text output is a rendering, not the data.

$ journalctl -u php7.3-fpm -o json --since '10 min ago' 
  | jq -r 'select(.PRIORITY|tonumber <= 3) | "(.__REALTIME_TIMESTAMP) (.MESSAGE)"'

$ journalctl -o json -f | your-shipper

# and the fields that are always there:
#   _SYSTEMD_UNIT  _PID  _HOSTNAME  PRIORITY  MESSAGE  _TRANSPORT

Following the journal in JSON and piping it to a shipper is a complete log pipeline with no agent to install, which is enough for a small estate and removes a moving part. The cursor field is what makes it resumable — recording it after each batch means a restart continues where it stopped rather than re-shipping a day. Setting SystemMaxUse deliberately matters here too, since the default is a percentage of the disk.