@emilymoxie Seems like a filebeat <> logstash issue if you're just pointing filebeat to a flat file that osquery produces.