@jintseng a helpful tip, running

osqueryi --config_check --config_path=/etc/osquery/osquery.conf

can help ensure that you're config is being seen and read correctly