Also it looks like logstash has a HTTP input plugin, and osquery has a http (aka tls output plugin). They might work together, or require small changes. https://www.elastic.co/blog/introducing-logstash-input-http-plugin https://github.com/facebook/osquery/blob/master/docs/wiki/deployment/remote.md