osqueryd --config_path ./osq.json --pidfile /tmp/osq.pid --database_path /tmp/osq.db --logger_path /tmp/

{
  "options": {
    "logger_event_type": false,
    "logger_plugin": "filesystem",
    "utc": "true"
  },
  "decorators": {
    "always": [
      "select unix_time as decorator_time from time"
    ]
  },
  "schedule": {
    "shell_history": {
      "query": "select * from time;",
      "interval": 5
    }
  }
}