Why not both?  Is what I was thinking.  I agree with you, personally, about attempting to durably transport and store logs.  If Kafka were not real-time enough for me I would probably consider a system where I routed logs to kafka and then into a more real-time system.