Using _--logger_plugin=tls_ flag, is for forwarding the logs from osquery agent to the fleet server? We already have the logs shipped to splunk from each of the osqueryd agent and we do not want logs from the agents sent to the fleet server. In that case, using _--logger_plugin=filesystem_ flag will solve our purpose?

yes

Thanks @sundsta