Also for an example
the following is content of osquery.flags file
I define --config_plugin=tls so my local osquery.conf file isnt used
--enroll_secret_path=/programdata/osquery/enroll_secret.txt
--tls_server_certs=/programdata/osquery/server.pem
--tls_hostname=server:8080
--host_identifier=hostname
--enroll_tls_endpoint=/api/v1/osquery/enroll
--config_plugin=tls
--config_tls_endpoint=/api/v1/osquery/config
--disable_distributed=false
--distributed_plugin=tls
--distributed_interval=10
--distributed_tls_max_attempts=3
--distributed_tls_read_endpoint=/api/v1/osquery/distributed/read
--distributed_tls_write_endpoint=/api/v1/osquery/distributed/write
--logger_plugin=tls
--logger_tls_endpoint=/api/v1/osquery/log
--logger_tls_period=3
--windows_event_channels=Windows PowerShell,Security
--events_optimize=true
--config_refresh=60
--config_accelerated_refresh=300
--config_tls_max_attempts=3
--logger_event_type=true
--logger_snapshot_event_type=true
--events_max=70000
--events_expiry=3600