filebeat.prospectors:
- input_type: log
  paths:
    - /var/log/osquery/osqueryd.results.log
    fields_under_root: true
    fields:
      tags: ['json']