@clippy - is your use case: a) ship local syslog from a single host using osquery? b) ship multiple logs files from a single host using rsyslogd configured to pipe to osquery instance on host? c) Using a host with osquery as a collector/aggregator and then forward?