Is there a reason you can't have osqueryd write directly to Firehose from each box?