We have a need right now to gather some specific data with osquery that is not regularly collected, and we eventually want that data to end up in our kinesis stream. For example, a handful of osquery queries are only executed if we determine that a device gets compromised. A requirement for this is that these queries do not regularly get executed (not scheduled). The alternative method of accomplishing this is to execute the queries with

osqueryi <query> --json > outfile.json

, where we then need to do something with

outfile.json

. I’d rather just leverage the existing osquery logger_plugin config to consume whatever ends up in

outfile.json