well, you should probably put osquery results in a separate index or sourcetype since they are parsed as JSON and the INFO/ERROR/WARNING logs are in more of a syslog format