It can be made 'reliable' if your client code supports it.
However, if ease of deployment is important to you (or you dont want to implement logic into your HEC client), a universal forwarder with indexer acknowledgement provides a robust level of durability.
So with this i came to conclusion that HEC + ack gives reliable service.
Here is first i send a event data and receive ack num . I query ack tk check the indexing status . If status is positive event is indexed .
If status is negative ...what would be my action item ? I need to wait or resend event ?
Yes, exactly that.
If you are comfortable building a client to send your logs from your own application etc, then HEC is definitely the way to go.
If you are looking to collect log files created by other applications or 3rd parties, then use a forwarder.