If there's a lot of interest in having osquery POST directly to an indexer, I have a branch that had osquery do this with splunk that I sitll haven't seen through to fruition, but we could have it function similarly for ES. If people want this I can spend some time polishing it and getting it landed