> 1. For my case (yea, they are kind of required audit data)

What kind and required by whom? Most of such things are "if you have all, good, if half an hour is missing, we'll do without those", not something akin to transaction data in relational database where you cannot lose even a single byte.

> I need the log to be able to not loss when sending to logstash or kafka

What is "not to lose logs"? Is losing a single record OK? Is losing 1% of logs OK? How long network problems should be tolerated? What to do if such network problems are longer than anticipated and disk buffer is running out of space?

You have said virtually nothing about what your logs consist of and what kind of reliability you require from them.