if you wanted possibly the simplest method of an alerting log pipeline, you could set osquery to ship your logs to aws firehose and use lambda to alert on certain things based on whatever code you write