I would say it really is how you want to see it done,
If your really pushed for resources, having one agent (Filebeat or rsyslog) would save you megs and CPU cycles
If you crash rsyslog you put the risk of your system freezing. Once enough Kernel level logs queue up, your system will freeze till you recycle rsyslog
Honestly, I know that filebeat is what everyone is using but I personally install the full version of logstash and do all my parsing on the system with the log files. Sort of a distributed processing, rather then a central server. But I am processing a lot of data.
Other then that I could not think of any reason to use one over the other.