Thank you for the detailed answer! It seems, the configuration file works because ntfs_journal_events seems to subscribing successfully, however yara doesn't execute or subscribe properly? I will try to change up the paths (\\ -? \ ) and tweak a little.

"yara": {
    "signatures": {
      // Each key is an arbitrary group name to give the signatures listed
      "sig_group_1": [ "new.yar" ]      
    },
    "file_paths": {
      // Each key is a key from file_paths
      // The value is a list of signature groups to run when an event fires
      // These will be watched for and scanned when the event framework
      // fire off an event to yara_events table
      "test": [ "sig_group_1" ],
	  "win_fevents_1": ["sig_group_1"],
	  "win_fevents_2": ["sig_group_1"]
     
    }
  },


 "file_paths": {
     "win_fevents_1": [
      "C:\\Windows\\system32\\Drivers\\%%\\",
      "C:\\Windows\\SysWOW64\\Drivers\\%%\\",
      "C:\\Windows\\system32\\GroupPolicy\\Machine\\%%\\",
      "C:\\Windows\\system32\\GroupPolicy\\User\\%%\\",
      "C:\\Windows\\system32\\Wbem\\%%\\",
      "C:\\Windows\\SysWOW64\\Wbem\\%%\\",
      "C:\\Windows\\system32\\WindowsPowerShell\\%%\\",
      "C:\\Windows\\SysWOW64\\WindowsPowerShell\\%%\\"
      ],
	   
	   "win_fevents_2": [
	  "C:\\Windows\\Tasks\\%%\\",
      "C:\\Users\\%\\AppData\\Roaming\\%",
      "C:\\Users\\%\\AppData\\Local\\%",
      "C:\\Users\\%\\AppData\\Local\\temp\\%",
      "C:\\Users\\%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\%",
      "C:\\Users\\%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\%",
      "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\%",
      "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\%"
	  ],
	   
	   
	   "test": ["C:\\new\\%"]
   },