For me, all td-agent.log messages are not being reflected in journalctl.

[jgmarce]

Could be specific to my hardening... When I block access to splunk, td-agent does recognize this and begins to placed [warn] messages in td-agent.log. I'd like to use journalctl (and the time bounding features) to report on the same log messages but those haven't been observed via journalctl for me. If some one could possibly confirm if it is the same for others, before I report an issue, please. To block splunk access I simply made a /etc/hosts entry for my splunk server set to 127.0.0.1 for a time....

[kenhys]

By default, td-agent is customized to output to /var/log/td-agent.log, not journal log.
Thus you must customize td-agent.serivce's ExecStart= because it specify --log option explicitly there.
(simply omit --log $TD_AGENT_LOG_FILE will work)