Yeah, I noticed that too, might test it to see if it helps. I was previously just referring to the original osquery docs: https://osquery.readthedocs.io/en/latest/deployment/file-integrity-monitoring/ and thought maybe ntfs_journal_events may follow the same syntax, however I don't think that page has been updated to include ntfs_journal_events.