this is also documented in the cli flag documentation although not with the explicit note on what kind of event each value should survive: https://github.com/facebook/osquery/blob/master/docs/wiki/installation/cli-flags.md