For out mac laptops, we ended up using filebeat. I kinda wish we'd gone with fluent, I'm finding logstash kinda hard to deal with.