You’re right, for somereason I thought I had done it but now I remember actually I was using filebeat to forward osquery logs until I switched to fleet.
Case still stands that it is madness that we need to use many agents just to do such simple tasks.