Befor add a prefix to your firewall filter
/ip firewall filter add chain=forward action=drop log=yes log-prefix="DROP"
And create a pipline with this grok on the field message
%{WORD:firewall.network.action} %{WORD:firewall.network.chain}: in:%{DATA:firewall.network.in_interface} out:%{DATA:firewall.network.out_interface}, connection-state:%{DATA:firewall.network.connection_state} src-mac %{MAC:firewall.source.mac}, proto %{DATA:firewall.network.protocol}, %{IPV4:firewall.source.ip}(?::%{NUMBER:firewall.source.port})?->%{IPV4:firewall.destination.ip}(?::%{NUMBER:firewall.destination.port})?, len %{NUMBER:firewall.network.bytes}