we only run Elk centrally and to collect logs on linux we use rsyslog ... wondering what would be a similar way to do that from Macs