Assistance Required with FortiSIEM Custom Parser Development

Hello FortiSIEM Community,

I’m currently working on creating a custom parser for  Aruba EdgeConnect logs in FortiSIEM, but I’m facing an issue during parser validation.

Each time I create or modify the parser, the validation fails with the following error:

Failed to execute node: when. Please check the usage of API and attribute name.

I have double-checked the parser XML and verified that the attributes I’m using, such as hostName, procName, user, command, eventType, destName, destIpAddr, and srcIpAddr, are defined and supported in FortiSIEM.

However, the error does not indicate which specific node, API, or attribute is causing the failure, which makes troubleshooting difficult.

I have attached a screenshot of the parser validation error along with the current parser configuration.

Would anyone with experience in FortiSIEM custom parser development be able to assist me in identifying the root cause and correcting the parser?

Any guidance or example of the correct parser structure would be greatly appreciated.

Thank you in advance for your assistance.