Forticlient Logging in FortiAnalyzer

I'm running some automated reporting against FortiClient logging in FortiAnalzyer and I have a few questions.

First, around the 'Username' field.  Our organization uses alias for the client's domain username, meaning Joe.Sixpack@company.com or JoeS@co.com are equally viable for logging in.  FortiClient users are unverified and authenticate using SAML against Azure EntraID.  For some users I see the username 'joe.sixpack' and others I see 'JoeS@co.com'.  The question is, how is that information being logged?  What is being used in the System Event logs for example.  Ideally, I'd have the username not the alias.

Secondly, there is other information being gleaned from the SAML authentication i.e. employee number and email address that I do not see in the logs. When I attempted to add the field to my custom report because when I hover over the 'source' variable $log, I see a field like euid which appears invalid when I try to test the query.

Any insight would be very helpful.  Thanks in advance, -Mark