Maybe this will help: https://osquery.readthedocs.io/en/latest/deployment/file-integrity-monitoring/ you need at least one other flag depending on your choice of file event source:

--enable_file_events=true

 for 

file_events

, 

--disable_audit=false

 for 

process_file_events

, 

--enable_ntfs_publisher=true

 for 

ntfs_journal_events