Visitor II
July 7, 2026
Question
Custom Parser Issue in FortiSIEM 7.5.1: eventName Overwritten by eventType Over Live Syslog (Works in Test UI)
- July 7, 2026
- 1 reply
- 33 views
Hello FortiSIEM Community,
I am developing a custom parser for a log source where both the Event Name and Event Type are dynamic strings extracted directly from the CEF log headers using regular expressions.
We recently upgraded our environment from v7.5.0 to v7.5.1, and we have run into a strange parsing behavior that wasn't happening in the previous version.
The Issue:
- In the Parser Test UI: When pasting a sample log into the debugger/test utility, the regex captures the tokens perfectly.
eventNameandeventTypeare differentiated and display their respective unique values. - Over Live Syslog: Once the parser is saved and a live log is forwarded via Syslog, the
eventTypevalue completely overwrites theeventNameattribute. In Analytics, both fields end up showing the exact same value (the event type string).
Has anyone experienced this specific regression or behavior change in the 7.5.1 live engine pipeline? Is there an updated syntax or a specific workaround to stop FortiSIEM from dynamically overriding an explicitly set eventName attribute for custom CEF formats?
Can someone please help us with this? Any insights or assistance would be greatly appreciated!
Thank you.
