Also, in the issue I recall you were asking about LogStash with osquery, we have a small example here: https://osquery.readthedocs.io/en/stable/deployment/log-aggregation/