@czanik awesome, please link us the blog when you have the full writeup. If you'd also be interested in updating the official docs, that would be great (https://github.com/facebook/osquery/blob/master/docs/wiki/deployment/syslog.md#configuration-1). Otherwise, I can try to adapt your blog post into those docs at some point.