Each option has its pros and cons. In the end it usually comes down to what your source can do.
syslog is usually lighter and easier to configure on the source side and much easier to come by as implemented in various solutions but usually needs some overhead on the receiving side to make sense of it.
Sending events to HEC can be more reliable and you can - for example - set up mutual authentication between sender and receiver but is more complicated to implement so it's not very often used.
