Fortianalyzer exceeds logs

If one notices that the FortiAnalyzer VM has consistently exceeded its licensed GB/day limit for over 7 days, this is a good time to think about a license upgrade and adjust resources. Although FortiAnalyzer VM will try its best not to drop logs, consistently running over capacity will eventually lead to undetermined behavior. This is because all FortiAnalyzer VM functions are validated within the licensed limit; the behavior beyond that limit is deemed to be unsupportable.

Ref: 

https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-Minimizing-logging-from-FortiGate-to-FortiAnalyzer/ta-p/198018

There is no definite answer to that - FTNT docs just say "beyond the limit we do not guarantee anything", so it may mean excess logs will be dropped, or may be not - no guarantees.