We are generating a new  custom report on firewall analyzer, but when I try to use url field it looks like:

108.160.162.44/subscribe?host_int=823801266&ns_map=73147300_287835956132

Even when dns resolution was activated, the site name never is the same as the website accessed.

We want that field shows up hostname, like bellow;

<190>date=2013-12-02 time=10:29:52 devname=FGT1KC3912802022 devid=FG800C3913800913 logid=1059028704 type=utm subtype=app-ctrl eventtype=app-ctrl-all level=information vd="root" attackid=17459 user="WROLIVEIRA" group="GG_FORTIGATE_ALLOW" srcip=10.1.82.28 srcport=50380 srcintf="CORP" dstip=108.160.162.44 dstport=80 dstintf="wan1" dstname="108.160.162.44" proto=6 service="http" policyid=99 identidx=1 sessionid=334768881 applist="GG_FORTIGATE_ALLOW" apptype="File.Sharing" app="Dropbox" action=pass count=1 hostname="notify8.dropbox.com" url="/subscribe?host_int=823801266&ns_map=73147300_287835956132,73145063_51208968215271&user_id=45533577&nid=1385928998826478849&ts=" msg="File.Sharing: Dropbox, "

See hostname in raw logs above.

It's possible to use this field on custom reports?

Tks