FMC/FTD eStreamer can't output NAT IP

[matgsdd]

FMC/FTD eStreamer can't output NAT IP information. Other event values are visible in splunk. Anyone else having same issue ?

[MHM Cisco World]

MHM

[matgsdd]

we can see NAT in FMC. This is an old article. It is not being forwarded by eStreamer or Splunk is not able to see them.

[MHM Cisco World]

MHM

[matgsdd]

Syslog and sStreamer are different things

[MHM Cisco World]

for syslog 305009 this NAT syslog message id. 
for estreamer I think NAT will appear when you select connection events 
if you dont see NAT message please share the eStreamer vendor you use 

link that I see helpful for you 

https://www.ciscolive.com/c/dam/r/ciscolive/global-event/docs/2022/pdf/BRKSEC-2124.pdf