osquery has multiple formats depending on your config and scheduled query type https://github.com/facebook/osquery/blob/master/docs/wiki/deployment/logging.md#schedule-results