My prod hosts push osquery through our syslog pipeline. Our laptops drop it as a file which is pushed by filebeat. All pretty straightforward.