In the case of a firewall filter with log/syslog action, if the filter applies to the output direction of the interface while traffic matches the output filter, running the command, 'show firewall log' will not display the attached interface, but the input interface instead.  This is expected behavior.

Topology and Configuration

• On r2, firewall filter filter-out is applied on interface xe-0/0/1.0 output
• Transit traffic is from r1 with source 1.1.1.1 to destination 3.3.3.3
• The traffic matches term 1 of output firewall filter filter-out of xe-0/0/1

user@r2# show firewall family inet filter filter-out
term 1 {
    from {
        source-address {
            1.1.1.1/32;
        }
        destination-address {
            3.3.3.3/32;
        }
    }
    then {
        count filter-out-xe001;
        log;
        syslog;
        accept;
    }
}
term 2 {
    then accept;
}

user@r2# show interfaces
xe-0/0/0 {
    unit 0 {
        family inet {
            address 10.0.0.2/30;
        }
    }
}
xe-0/0/1 {
    unit 0 {
        family inet {
            filter {
                output filter-out;
            }
            address 10.1.0.1/30;
        }
    }
}

Start ping from r1 and check the filter counter on r2. You can see firewall log with packets arriving at interface (xe-0/0/0), but not the output filter attached interface (xe-0/0/1).

user@r1> ping 3.3.3.3 source 1.1.1.1 no-resolve
PING 3.3.3.3 (3.3.3.3): 56 data bytes
64 bytes from 3.3.3.3: icmp_seq=0 ttl=63 time=36.226 ms
64 bytes from 3.3.3.3: icmp_seq=1 ttl=63 time=50.204 ms
......

user@r2> show firewall counter filter filter-out filter-out-xe001   
Filter: filter-out                                             
Counters:
Name                                                Bytes              Packets
filter-out-xe001                                     6296                   78

user@r2> show firewall log
Log :
Time      Filter    Action Interface     Protocol        Src Addr                         Dest Addr
23:12:00  pfe       A      xe-0/0/0.0  ICMP            1.1.1.1                          3.3.3.3
23:11:59  pfe       A      xe-0/0/0.0  ICMP            1.1.1.1                          3.3.3.3
......

user@r2> show log messages |match FW_SYSLOG    
Sep 22 23:11:58  r2 fpc0 PFE_FW_SYSLOG_ETH_IP: FW: xe-0/0/0.0 A 0800 2c:6b:f5:99:79:00 -> 2c:6b:f5:52:23:00 icmp 1.1.1.1 3.3.3.3     8     0 (1 packets)
Sep 22 23:13:32  r2 fpc0 PFE_FW_SYSLOG_ETH_IP: FW: xe-0/0/0.0 A 0800 2c:6b:f5:99:79:00 -> 2c:6b:f5:52:23:00 icmp 1.1.1.1 3.3.3.3     8     0 (1 packets)
......
 

This is expected behavior. The output fields for the 'show firewall log' command displays a physical interface name if the packet arrived at a port on a line card.

For more information, refer to the technical document on show firewall log