[monitor:///var/log/osquery/osqueryd.results.log]
index = main
sourcetype = osquery_results

[monitor:///var/log/osquery/osqueryd.*INFO*]
index = main
sourcetype = osquery_info

[monitor:///var/log/osquery/osqueryd.*ERROR*]
index = main
sourcetype = osquery_error

[monitor:///var/log/osquery/osqueryd.*WARNING*]
index = main
sourcetype = osquery_warning