inputs.conf for PAN app when collecting from syslog server

We already have the pan devices logging to our syslog-ng server. I have deployed the the following inputs.conf to the forwarder:

# syslog forwarder inputs
  [monitor:///var/log/syslog/PaloAlto/]
  host_segment = 5
  index = pan_logs
  sourcetype = pan_log
  blacklist = \.(gz|bz2)$

Data is hitting the pan_logs index however none of the dashboards are populating. After looking at some of the searched I noticed other pan sourcetypes that are not being populated. I assume these are supposed to be rewritten at index time? . All data in the pan_logs index is sourcetype = pan_log. Any ideas ?