HX can export events in multiple formats as far as I remember (bonus question - are you talking about operational logs or security events?) so you can also look on the HX's side to check its configuration.
Please share your configuration as it is probably something amiss there. Also, please share your raw event (anonymised of course), preferably in a code block so we can see all the spacing, so we can figure out what needs changing in the configuration.
