If you have configured osquery to send the events through the backend, then it will retain the events till it sends the events to a backend, like Uptycs (osquery sends events to Uptycs as soon as it occurs, doesn’t wait for scheduled query packs to read the events).
As soon as you perform SELECT on events *_events table, osquery will flush all the events. About --events-expiry, flag is only for keeping the events if you haven’t query the events table. However, osquery may remove the events; if osquery memory is full and new events come, then based on LIFO, it may remove the events.
In the case of Uptycs, osquery sends the events directly to Uptycs as it occurrs in near real time.