Explanation
We know that SSL decryption is supposed to give us visibility of traffic that would otherwise be encrypted.
Therefore, we'd expect decrypted traffic to be identified as the underlying applications, such as web-browsing, facebook-base or other, but not as SSL.

Create a new log forwarding profile which forwards logs only to Syslog device. Create a specific security policy for DNS traffic
https://live.paloaltonetworks.com/t5/general-topics/how-to-stop-dns-traffic-logs-going-to-log- collector/td-p/290425

https://docs.paloaltonetworks.com/panorama/10-0/panorama-admin/manage-firewalls/set-up-zero-touch-provisioning/add-ztp-firewalls-to-panorama/add-a-ztp-firewall-to-panorama.html#id182211ac-a31c-4122-a11f-19450ec9ca4e

Reference:
The Application Command Center (ACC) page visually depicts trends and a historic view of traffic on your network. It displays the overall risk level for all network traffic, the risk levels and number of threats detected for the most active and highest-risk applications on your network, and the number of threats detected from the busiest application categories and from all applications at each risk level. The ACC can be viewed for the past hour, day, week, month, or any custom-defined time frame.