FG 60C logging.

I just recently set this firewall up and have been watching the amount of traffic going in and out. I have a lab with 2 hyper-v servers and about 30 VMs. (not all running at the same time). Over the last few days a large amount of traffic has gone out from Internal to WAN1. 

The logs aren't really telling me much and I am a little confused. How can I tell which internal IP is sending/receiving so much traffic over internal >> WAN1. ? 

How can I tell what type of traffic is being sent? HTTP, FTP etc? 

Thanks, 

Robert