People aggregate logs in any number of ways. * Some people use a TLS server. Either open source or commercial. There are several SaaS vendors (I work for one) * Some people use a custom plugin to ship logs * Or the native osquery log shipping * Some people write logs to local disk, and then ship those with something like filebeat It depends a bit on what makes sense for the local environment. A related question is how osquery configuration is distributed.