The reason field is in every FortiRecorder log message where type=kevent. The reason field indicates the reason for the action (if any).
reason
type=kevent