The architecture of the Talend Event Monitoring is based on Apache Karaf Decanter.
Log and Locator Monitoring Events are collected by the Decanter Log Collector while SAM and OSGi Events are sent to the Event Admin first and then collected by the Decanter EventAdmin Collector.
All collector events will be transferred to a common decanter topic in the Event Admin and from there consumed by the related appenders.
The picture below shows the default deployment architecture with the individual components and how they interact with each other. A log-appender for Decanter produces a local file (files essentially, as we use a rolling file appender configuration for Log4J2), and this file is then consumed by FileBeat and transferred to the Talend LogServer (logstash). The log data can be accessed via the ESB Dashboards provided in the Talend Administration Center Logging page (based on Kibana).