Hello FortiSIEM Community,I am working with FortiSIEM Version 7.3.2 and facing an issue where some custom attributes are not appearing in parsed logs. Here’s the setup:Created new custom attributes for MSSQL JDBC performance monitoring.Defined an event type and mapped all custom attributes according to SQL query output columns.Added 30-40 new attributes across different databases.In RAW logs, only a few custom attributes appear to be parsed, while most are missing.The PHBOX parser is being used, as indicated in the raw logs.Additionally, I have written a custom parser within the same setup, and the attributes belonging to that parser are successfully parsed.I would appreciate any insights on why attributes mapped through PHBOX parser are not appearing, and how I can resolve this issue.Has anyone encountered something similar, or can you suggest troubleshooting steps?Thanks in advance for your help!

Explorer III

Question

FortiSIEM Issue with Custom Attributes Parsing

Hello FortiSIEM Community,

I am working with FortiSIEM Version 7.3.2 and facing an issue where some custom attributes are not appearing in parsed logs. Here’s the setup:

Created new custom attributes for MSSQL JDBC performance monitoring.
Defined an event type and mapped all custom attributes according to SQL query output columns.
Added 30-40 new attributes across different databases.
In RAW logs, only a few custom attributes appear to be parsed, while most are missing.
The PHBOX parser is being used, as indicated in the raw logs.
Additionally, I have written a custom parser within the same setup, and the attributes belonging to that parser are successfully parsed.

I would appreciate any insights on why attributes mapped through PHBOX parser are not appearing, and how I can resolve this issue.

Has anyone encountered something similar, or can you suggest troubleshooting steps?

Thanks in advance for your help!