At present the Fortigate syslog Source Name is pulled from the 'host.ip' field in the logs. It would be useful if this could either pull from the host.hostname field, select from a selection of different fields, or allow renaming of sources