Syslog - EventLog Analyzer

I have a Sonicwall firewall that sends to a Kiwi syslogd and to ELA. The Kiwi syslogd is logging about 100X more entries than the ELA. Is there something that I am missing in the ELA configuration?