Thanks for your quick answers.
What about the CLI xo-server-logs then ?
It seems to export only error logs, does these logs comes from audit logs and is it possible to change the severity in order to get all logs ?
I think that it can do the job especially if it generate json, that's something that we can easily pipe into a analyse tool like an elastic stack. I think it can be ok if it async (via crontab for example).