{
  "decorators": {
    "always": [
      "SELECT instance_id, region, availability_zone, local_ipv4, account_id FROM ec2_instance_metadata;"
    ],
    "load": [
      "SELECT uuid AS host_uuid FROM system_info;",
      "SELECT user AS username FROM logged_in_users ORDER BY time DESC LIMIT 1;"
    ]
  },
  "file_paths": {
    "c": [
      "C:\\Program Files\\osquery\\logs\\%"
    ]
  },
  "options": {
    "disable_logging": "false",
    "disable_tables": "",
    "host_identifier": "hostname",
    "verbose": "true"
  },
  "schedules": {
    "file_events": {
      "interval": 300,
      "query": "SELECT * FROM ntfs_journal_events;"
    }
  }
}

--disable_events=false
--enable_ntfs_event_publisher=true

I1221 19:45:27.390025  2224 ntfs_event_publisher.cpp:544] FRN pathname lookup failed, trying parent: Failed to open the file in volume C:\. Error: The parameter is incorrect.

select * select * from osquery_events;
+--------------------------+--------------------------+------------+---------------+--------+-----------+--------+
| name                     | publisher                | type       | subscriptions | events | refreshes | active |
+--------------------------+--------------------------+------------+---------------+--------+-----------+--------+
| WindowsEventLogPublisher | WindowsEventLogPublisher | publisher  | 0             | 0      | 0         | 1      |
| ntfs_event_publisher     | ntfs_event_publisher     | publisher  | 1             | 0      | 5         | 1      |
| ntfs_journal_events      | ntfs_event_publisher     | subscriber | 1             | 0      | 0         | 1      |
| powershell_events        | WindowsEventLogPublisher | subscriber | 0             | 0      | 0         | 0      |
| windows_events           | WindowsEventLogPublisher | subscriber | 0             | 0      | 0         | 0      |
+--------------------------+--------------------------+------------+---------------+--------+-----------+--------+