Threat input for Palo Alto PAN-OS 8.0 not being read

## Description
While traffic and system logs are being read from a firewall running PAN-OS 8.0, graylog is not recording any threat logs sent.

I have captured a packet that shows that the threat log is being sent correctly:
`553 <14>1 2019-10-07T17:17:05-04:00 HOSTNAME - - - - 1,2019/10/07 17:17:05,009401017766,THREAT,url,1,2019/10/07 17:17:05,IPADDRESS,IPADDRESS,IPADDRESS,IPADDRESS,SECURITYPOLICY,USERNAME,,web-browsing,vsys1,trust,untrust,ethernet1/3,ethernet1/6,Graylog,2019/10/07 17:17:05,34710,1,49670,80,4456,80,0x403000,tcp,block-override,URL,(9999),adult,informational,client-to-server,45398645,0x0,10.0.0.0-10.255.255.255,Czech Republic,0,,0,,,1,,,,,,,,0,0,0,0,0,,HOSTNAME,,,,get,0,,0,,N/A,unknown,AppThreat-0-0,0x0`
## Steps To Reproduce

1. Set up a Palo Alto device to send threat logs ([documentation for 8.0 here](https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-admin/monitoring/use-syslog-for-monitoring/configure-syslog-monitoring.html))
The Syslog Server Profile settings used for our system are
```
- Name: Graylog
- Syslog Server: IPADDRESS
- Transport: TCP
- Port: 5555
- Format: IETF
- Facility: LOG_USER
```
We send all logs with no filters.

2. Set up a Palo Alto Networks TCP Input (TCP) on the graylog server. The message mappings must match the Palo Alto documentation for the version of Pan-OS being used on the firewall. [The 8.0 syslog fields for threat can be found here](https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/threat-log-fields.html). Ours are set up matching the documentation like so:
```
THREAT_TEMPLATE: position,field,type
1,Receive_Time,STRING
2,Serial_Number,STRING
3,Type,STRING
4,Threat_Content_Type,STRING
5,FUTURE_USE,STRING
6,Generated_Time,STRING
7,Source_IP,STRING
8,Destination_IP,STRING
9,NAT_Source_IP,STRING
10,NAT_Destination_IP,STRING
11,Rule_Name,STRING
12,Source_User,STRING
13,Destination_User,STRING
14,Application,STRING
15,Virtual_System,STRING
16,Source_Zone,STRING
17,Destination_Zone,STRING
18,Inbound_Interface,STRING
19,Outbound_Interface,STRING
20,Log_Action,STRING
21,FUTURE_USE,STRING
22,Session_ID,STRING
23,Repeat_Count,STRING
24,Source_Port,STRING
25,Destination_Port,STRING
26,NAT_Source_Port,STRING
27,NAT_Destination_Port,STRING
28,Flags,STRING
29,Protocol,STRING
30,Action,STRING
31,URL_Filename,STRING
32,Threat_ID,STRING
33,Category,STRING
34,Severity,STRING
35,Direction,STRING
36,Sequence_Number,STRING
37,Action_Flags,STRING
38,Source_Location,STRING
39,Destination_Location,STRING
40,FUTURE_USE,STRING
41,Content_Type,STRING
42,PCAP_ID,STRING
43,File_Digest,STRING
44,Cloud,STRING
45,URL_Index,STRING
46,User_Agent,STRING
47,File_Type,STRING
48,X_Forwarded_For,STRING
49,Referrer,STRING
50,Sender,STRING
51,Subject,STRING
52,Recipient,STRING
53,Report_ID,STRING
54,Device_Group_Hierarchy_Level_1,STRING
55,Device_Group_Hierarchy_Level_2,STRING
56,Device_Group_Hierarchy_Level_3,STRING
57,Device_Group_Hierarchy_Level_4,STRING
58,Virtual_System_Name,STRING
59,Device_Name,STRING
60,FUTURE_USE,STRING
61,Source_VM_UUID,STRING
62,Destination_VM_UUID,STRING
63,HTTP_Method,STRING
64,Tunnel_ID_IMSI,STRING
65,Monitor_Tag_IMEI,STRING
66,Parent_Session_ID,STRING
67,Parent_Start_Time,STRING
68,Tunnel_Type,STRING
69,Threat_Category,STRING
70,Content_Version,STRING
71,FUTURE_USE,STRING
```
3. Generate a threat event on the firewall. I find the easiest way to do this is to set the adult category to block and to visit an obviously adult oriented website. Websites blocked due to category are generated as a THREAT event in addition to the TRAFFIC event. You can see if it got logged by going into the URL Filtering log in the monitor tab of the firewall, locating the entry, then clicking the magnifying glass.

4. That's it for our environment. The log definitely gets sent and is received by graylog (as evidenced by the packet capture) but graylog is not saving it.

## Environment

- Graylog Version: 3.1.0+aa5175e
- Elasticsearch Version: 6.8.2
- MongoDB Version: 4.0.12
- Browser Version: Chrome 77.0.3865.90 (Official Build) (64-bit)