filebeat should work pretty well. But the main point here is that once logs are created on host, osquery is out of the picture for where they get forwarded to, unless you're using TLS/Firehose