In the /var/log/messages file a similar error as below will be indicated. Jul 11 16:49:35 Logdecoder NwLogCollector: [GenericLogTransformer] [warning] Failed to locate message id field during event transformation. The message id field number is 5. The raw event is "0x7fd,6ca,956,1e0". The message will still be delivered.
This issue is due to incorrectly formatted events from syslog or file collection sources. These incorrectly formatted events are identified by checking the Events page using a device.type='unknown' query to see the below problematic events.
Work with the event source owner to stop or fix the problematic events. The device the event is coming from can be identified by the device.ip meta associated with the event.