[monitor:///var/log/osquery/osqueryd.results.log]
sourcetype = osquery:results
index = osquery