or is the best way to get actual osquery JSON packs and convert them using fleetctl?

You can use fleetctl convert -f file.conf and it will generate a yml file