but it seems like osquery is used to just ship logs to some aggregator

I would describe osquery as an interface to underlying system APIs. If you’re developing a tool, you can write code to talk to an API, you can write code to talk osquery.