@Moonlight

log_string

will only be called when a scheduled query returns results -- therefore never in osqueryi -- you'll need to use osqueryd with a schedule.