Is there away to pull logs into logstash without installing a shipper agent on every vm?
Since this isn't a question about logstash-forwarder you may get better answers if you edit your post and change the category to Logstash.
Filebeat has a very small overhead and shouldn't be hard to install in each VM. Another option could be to store the logs in a shared file system (e.g. NFS) that a single Logstash process can access.
Thanks for the information and I have changed the category to Logstash!
You can also use rsyslog to send it over TCP.