Ithink the issue you are having is the same issue I am having. The issue is that you have to configure the F5 to send event logs in NEDS format. for me I have to create an iRule, and I am trying to figure that out. if someone else know how to do this, I am all ears.
I have configured the F5-system based on a kb-article how to configure syslog-ng to send its data to the ESM.
If you want, i can post the link.