Device ID
If you configure FortiMail to send logs to FortiAnalyzer or other Syslog servers, then the device ID (device_id) field is added to the header. Remote log servers often receive log messages from many devices, so the serial number in the device_id field indicates which device recorded the log messages.
This field does not appear when you download log files to your computer directly from FortiMail, or view logs on FortiMail itself.
The log server may also add log fields locally, and therefore log messages viewed on FortiMail may not be completely identical.