IF you do you shell history, use something like this

"shell_history": {
      "query": "select * from users join shell_history using (uid);",
      "description": "pulls all shell history from all users, not just current osquery user",
      "interval": 300
    }`

as it will at least get all users