Using fluentd. I know I can filter them out in post, but I think to do it in fluentd would require a fork of the code. Plus I honestly just dont want a million security events in the WEL from osquery if possible