I can see that rsyslog is writing logs in the pipe, so every step described that seems to be OK. I am wondering if osqueryd is reading my flags file with:

cat /etc/osquery/osquery.flags
--enable_syslog
--disable_events=false