for real-time log ingestion and processing, I have Filebeat running on all our Mac endpoints, sending logs to Logstash and on to Elasticsearch. Works pretty well for us.