Firewall log in ECS

Just for clarification, if "the logger details would not be captured in any ECS field", don't we loose information?

In theory yes, but it's a question of scope. ECS has defined a scope that excludes message queues and ETL components, including loggers. If information about the logger is important to your use case, you can always create a custom field/field set to hold information about the logger or any other devices that might be in the path between the event source and the Elasticsearch store.

Would something like observer.logger.hostname be within the intentions of ECS?

Not presently.