if i was doing this, i would use fleet as an osquery server and then run a log tailer that processed each log and made a log-by-log decision on whether or not to increment a counter or what have you