root@hq-o:/etc/osquery# cat osquery-local.conf
{
  "schedule": {
    "process_events": {
      "query": "SELECT * FROM process_events;",
      "interval": 10,
      "snapshot" : false
    }
  },

  "decorators": {
    "load": [
      "SELECT uuid AS host_uuid FROM system_info;",
      "SELECT user AS username FROM logged_in_users ORDER BY time DESC LIMIT 1;"
    ]
  }
}

--logger_plugin='syslog,filesystem'

logger_plugin

syslog