@pvirani: we tested a setup for training purposes last year that used LogStash agents on Linux hosts to forward logs to ElasticSearch, the setup looked like: http://osquery.readthedocs.io/en/stable/deployment/log-aggregation/#logstash