SC4S parsing issues

[Jasem]

I have set SC4S up using Docker CE and systemd. In env file, I have a HEC endpoint url and a custom UDP port open, here is the error I get for 100% of Cisco FTD logs:

dtparse: Expected:                      '%b %d %H:%M:%S.%f',                     '%b %d %H:%M:%S',                     '%b %d %I:%M:%S %p.%f',                     '%b %d %I:%M:%S %p',                     '%b %d %Y %I:%M:%S %p.%f'                     '%b %d %Y %H:%M:%S.%f',                     '%b %d %Y %H:%M:%S',                 ; Actual: 	60,905

and for Fortiweb logs, I get all logs parsed with no host field extracted. has anyone faced these issues before?
Thanks in advance.

[PickleRick]

This suggests discrepancy between sc4s parsing rules and the actual event format. Have you actually compared your events with "standard" events sc4s expects? AFAIR sc4s project site lists specific configurations that need to be applied on the source side so that it produces events compatible with sc4s.