Yeah, it's

--syslog_events_expiry

and

--syslog_events_max

(https://osquery.readthedocs.io/en/stable/deployment/syslog/#other-configuration). We had decided that one should be able to control the expiration for that separately.