It's already there, it's supported by most logging packages, and it's dead simple. No additional software required. All text. What it doesn't do is structured logging, but analyzing on the log host is often enough.
Agents aren't all that bad however, and you're likely already running some agent like icinga or zabbix for regular monitoring.
also, with Netdata you can achieve the same architecture design using a Netdata Parent that could be your "control node" and to where you stream the metrics of the nodes you want to keep running with as less load as possible - you can even offload the health engine and the machine learning
take a look at https://learn.netdata.cloud/docs/streaming/ and https://learn.netdata.cloud/docs/configuring/how-to-optimize...
rsync --append is your friend.
It's also not as effective as streaming them to their intended target directly. Syslog can write a complementary local copy too should you wish to keep one.
Logs has been a thing since the past forty years. In order to reinvent it, it is good to be acquainted with the standard systems.
Normally you'd avoid all that complexity by shipping logs the other way, sending from each machine. That way you can keep state locally should you need to. All unix-like systems do this out of the box, and almost all software supports the syslog protocol to directly stream logs. But you can also use something like filebeat and a bunch of other modern alternatives.
The analyzer can then run locally on the log server and a whole lot of complexity just disappears.