suser not showing up in Syslog events

We are not seeing suser (Jimmy Smit) being extracted out of the "Remote code execution attempt" logs. Is this something that can be added? example:  2020-01-09T10:10:22-08:00 SyslogServerA CEF[4...