I use Journalbeat to forward my systemd-journal to Logstash/Elasticsearch. When possible, I configure every software on my servers to log to syslog which on moderns systems means logging to systemd-journald. If they don't support syslog I can also log to stdout which systemd writes to the syslog by default