In the case of a firewall filter with log/syslog action, if the filter applies to the output direction of the interface while traffic matches the output filter, running the command, ' show firewall log' will not display the attached interface, but the input interface instead.  This is expected behavior.

Topology and Configuration

• On r2, firewall filter filter-out is applied on interface xe-0/0/1.0 output
• Transit traffic is from r1 with source 192.168.1.1 to destination 192.168.3.3
• The traffic matches term 1 of output firewall filter filter-out of xe-0/0/1

user@r2# show firewall family inet filter filter-out
term 1 {
    from {
        source-address {
            192.168.1.1/32;
        }
        destination-address {
            192.168.3.3/32;
        }
    }
    then {
        count filter-out-xe001;
        log;
        syslog;
        accept;
    }
}
term 2 {
    then accept;
}

user@r2# show interfaces
xe-0/0/0 {
    unit 0 {
        family inet {
            address 10.0.0.2/30;
        }
    }
}
xe-0/0/1 {
    unit 0 {
        family inet {
            filter {
                output filter-out ;
            }
            address 10.1.0.1/30;
        }
    }
}

Start ping from r1 and check the filter counter on r2. You can see firewall log with packets arriving at interface (xe-0/0/0), but not the output filter attached interface (xe-0/0/1).

user@ r1 > ping 192.168.3.3 source 192.168.1.1 no-resolve
PING 192.168.3.3 (192.168.3.3): 56 data bytes
64 bytes from 192.168.3.3: icmp_seq=0 ttl=63 time=36.226 ms
64 bytes from 192.168.3.3: icmp_seq=1 ttl=63 time=50.204 ms
......


user@ r2 > show firewall counter filter filter-out filter-out-xe001   
Filter: filter-out                                             
Counters:
Name                                                Bytes              Packets
filter-out-xe001                                     6296                   78

user@ r2 > show firewall log
Log :
Time      Filter    Action Interface     Protocol       Src  Addr                         Dest Addr
23:12:00  pfe       A      xe-0/0/0.0   ICMP            192.168.1.1                          192.168.3.3
23:11:59  pfe       A      xe-0/0/0.0   ICMP            192.168.1.1                          192.168.3.3
......

user@r2> show log messages |match FW_SYSLOG    
Sep 22 23:11:58  r2 fpc0 PFE_FW_SYSLOG_ETH_IP: FW: xe-0/0/0.0 A 0800 2c:6b:f5:99:79:00 -> 2c:6b:f5:52:23:00 icmp 192.168.1.1 192.168.3.3     8     0 (1 packets)
Sep 22 23:13:32  r2 fpc0 PFE_FW_SYSLOG_ETH_IP: FW: xe-0/0/0.0 A 0800 2c:6b:f5:99:79:00 -> 2c:6b:f5:52:23:00 icmp 192.168.1.1 192.168.3.3     8     0 (1 packets)
...... 

This is expected behavior. The output fields for the 'show firewall log' command displays a physical interface name if the packet arrived at a port on a line card.

For more information , refer to the technical document on show firewall log

• show firewall log