Thank you for your reply.
As you pointed out, it was the description of TR4303.
In summary, the tls usage of syslog transfers in ONTAP 9 is understood below. is it right?
Event to be notified by "event notification"
⇒Transfer via UDP 514 and sent in clear text
Audit-logs that can be monitored by "cluster log-forwarding create"
⇒ Use TLS