You might also be able to fowrard logs to logstash with logstash https://github.com/facebook/osquery/blob/6f034a71567ce237454943eb623e13eeafb4592a/docs/wiki/deployment/log-aggregation.md#logstash