So my first guess is you are on the right track and its a format issue. Graylog will throw out messages that dont follow the format that they should (you should be able to see that in the server.log)
There is a pipeline rule posted in this thread and some instructions that should help Fortinet CEF Formatting issues - #11 by rfinney