okay thanks guys. Bookmarked filebeat and spoke to our ELK sysad. He thinks we would prefer either using a native mac syslog output utility of some sort (if it exists) or rsyslog. I'll update you guys with what we end up doing in the end so it helps somebody else facing a similar problem in future 🙂