If you are using Graylog (ELK Stack) you want to use Filebeat. Using rsyslog also to simply satisfy a test seems overkill.
We have many cases of this; for example (maybe not the best one) we run AIDE from a cron.daily/aide file that mails results.
And yes, while we fail the SCAP tests, we have defined alternate tests in our configuration that confirm proper operation.
As we build out component level verification for OpenControl, we are finding additional tests are needed, too.
I can see that this diverges from a clean "Red Hat Way" but sometimes systems are different - and perhaps more secure?
Sometimes compliance can be the enemy of security.
=Fen