just forwarding the hosts logs from journald to a openobserve running in a vm on that host requires using an agent that will cause you more reasons to have to observe a log than anything else.

And syslog/syslogng are also problematic to ingest.