FortiSIEM Issue with Custom Attributes Parsing

[beingarif]

Hello FortiSIEM Community,

I am working with FortiSIEM Version 7.3.2 and facing an issue where some custom attributes are not appearing in parsed logs. Here’s the setup:

• Created new custom attributes for MSSQL JDBC performance monitoring.
• Defined an event type and mapped all custom attributes according to SQL query output columns.
• Added 30-40 new attributes across different databases.
• In RAW logs, only a few custom attributes appear to be parsed, while most are missing.
• The PHBOX parser is being used, as indicated in the raw logs.
• Additionally, I have written a custom parser within the same setup, and the attributes belonging to that parser are successfully parsed.

I would appreciate any insights on why attributes mapped through PHBOX parser are not appearing, and how I can resolve this issue.

Has anyone encountered something similar, or can you suggest troubleshooting steps?

Thanks in advance for your help!

[beingarif]

@Anthony_E  @Secusaurus can you please help here.

[cdurkin_FTNT]

Can you provide a sanitized raw message.. and some example of Custom Attributes that parse and ones that do not.