Trying to get syslog-ng working with osquery on CentOS 7. I did all the tricks detailed on https://github.com/facebook/osquery/issues/1964 and https://github.com/facebook/osquery/issues/3166 and in this syslog-ng thread: http://lists.balabit.hu/pipermail/syslog-ng/2017-April/023669.html but still nothing shows up in the syslog table:

[root@localhost osquery]# osqueryi --config_path=/etc/osquery/osquery.conf
Using a virtual database. Need help, type '.help'
osquery> .all syslog
osquery> .features
disable_audit: true
disable_caching: false
disable_database: true
disable_decorators: false
disable_distributed: true
disable_enrollment: false
disable_events: false
disable_extensions: false
disable_forensic: true
disable_kernel: false
disable_logging: false
disable_memory: false
disable_reenrollment: false
disable_watchdog: true
enable_foreign: false
enable_monitor: true
enable_syslog: true

I double checked: log messages arrive to the pipe (stopped osquery and used cat...) /me is from syslog-ng upstream and plan to blog about it / extend osquery documentation, once it works