@finid osqueryd logging to filesystem, and logstash reading from filesystem on an ELK vm is probably the most straightforward setup, could probably have pretty charts in < 1 hour