This article explains the format that are supported by vJATP for syslog

Bluecoat was able to sent logs to vJATP but the counters are still getting updated

vJATP only support XML JSON and CSV format when we create a external collector for logs.

We also have a "other" format option but that is a grok format.

To use select input the "raw log" and select "others" and check if it's able to parse.