Am i right in thinking that Fleet itself doesn't pull back and store the results of scheduled queries and that if I want access to those results I'll need to ship them to some form of log aggregator?

The results of scheduled queries are stored in results.log

On the endpoint filesystem as opposed to the fleet server itself?

You can have the logger be the local filesystem on the endpoints, or use a tls logger which will send the logs to your fleet instance.

Thanks, when using the tls logger, whereabouts on the fleetserver are those logs stored?

Thanks, I'd looked at that page before but clearly didn't read it properly.

No problem - sometimes it is easier to read documentation when you already are familiar with the product

Note that Fleet can now log directly to AWS Firehose, and soon GCP PubSub.