In some situations the reporting Edge SWG (ProxySG) which uploads access logs is different than the proxy which creates a custom header, this article goes into the steps on how to implement it.
Add a custom header at the child proxy:
Use same header in the parent proxy: