osquery should not purge logs until they are successfully sent (except when the buffer overflows). My experience is mostly with mac and linux, so it's possible there's a bug in the windows implementation?