@David Rojas maybe take a stab at the question and see if anyone bites 🙂 otherwise i'd blindly point you at https://osquery.readthedocs.io/en/stable/deployment/log-aggregation/