A FortiWeb can be configured to join a Security Fabric through the root or downstream FortiGate.
When FortiWeb is running as HA especially A-A mode, the web traffic will offload from master to slave unit.
However, there is no way in the Log&Report to view the traffic/attack log from the slave.
This article explains how to view the log in the slave.

There are 2 solutions:

1) Access the Slave unit on the HA management interface and view the logs there.

2) Access to the master and go to System -> HA Cluster -> HA topology, click on the slave unit on the topology diagram. The View logs option will appear.