It should work similar to how the lightweight splunk forwarders work, where it runs as a client on your endpoints, and forwards the data to your centralized ES store