decoder sibling

[German DiCasas]

hi team,

I was reading documentation.wazuh.com/current/user-manual/ruleset/decoders/sibling-decoders.html and I want to make that with the syslog of fortianalyzer but not work for now.

I have wazuh 4.14.5 with this decoder custom

<decoder name="fortinet-fortianalyzer">
  <prematch type="pcre2">logver=\d+\s+timestamp=\d+\s+devname="[^"]+"\s+devid="[^"]+"</prematch>
</decoder>


<decoder name="fortinet-fortianalyzer">
  <parent>fortinet-fortianalyzer</parent>
  <regex>devname="([^"]+)"</regex>
  <order>devname</order>
</decoder>

And this is the log to test

<!--
2026 Jul 13 17:26:37 hostnameX->172.16.8.178 logver=706063652 timestamp=1783974452 devname="Source_X" devid="FGT80GTK66004666" vd="TI" date="2026-07-13" time="17:37:32" eventtime=1783974452453343129 tz="-0300" logid="0113022123" type="event" subtype="sdwan" level="notice" logdesc="SDWAN status" eventtype="Service" serviceid=6 service="vpn_service_1" metric="jitter" seq="7,4,5,6" msg="Service prioritized by performance metric will be redirected in sequence order."
-->

The decoder test show until Phase 2 and not showme  devname that is Source_X

**Phase 2: Completed decoding.
name: 'fortinet-fortianalyzer' 

The sibling structure seems to be that it is no ok. let me know how it will work.

Regards,

German

[Stuti Gupta]

Please allow me some time. I'm looking into this.

[Stuti Gupta]

Hi 

The issue is with the sibling decoder regex. Please use the following decoder:

<decoder name="fortinet-fortianalyzer">
             <parent>fortinet-fortianalyzer</parent>

              <regex>devname="(\.+)"</regex>
              <order>devname</order>
</decoder>

Then test the log. Let me know if the issue is resolved. 

To know more about decoder regex, you can refer to https://documentation.wazuh.com/current/user-manual/ruleset/ruleset-xml-syntax/regex.html

[German DiCasas]

Hi Stuti, good...

Right now it is working the sibling decoder.  I will be testing . Thanks

Regards

German