osquery is a little more suited to detecting changes in the operating system state, or gauging system compliance. The problem of parsing and forwarding logs off of a box has been better solved with other tooling..