osquery vs send all the logs centrally