that’s what I did, I followed that guide, configured the flags

# cat /etc/osquery/osquery.flags
--enable_syslog
--disable_events=false

and confiured rsyslog and restarted both daemons