with logger_plugin=tls,syslog enabled the real time queries sent from kolide are logged on both or always only to tls endpoint?

Logger plugin will have no effect on live queries. See https://github.com/kolide/fleet/blob/master/docs/infrastructure/faq.md#where-are-my-query-results.

ah ok, so there are no ways to store the results, only scripting around fleetctl

Correct