[Watchguard_firebox] Bugfix, traffic pipeline returns errors when log.duration has seconds suffix

[eset-122346]

Proposed commit message

WHAT:

A grok processor was added to the pipeline_traffic.yml ingest pipeline, inserted immediately before the existing convert processor for watchguard_firebox.log.duration. The new grok step uses the pattern %{NUMBER:watchguard_firebox.log.duration} to extract only the numeric value from the field, stripping any trailing non-numeric text. The changelog was updated with a 1.6.3 bugfix entry and the package version in manifest.yml was bumped from 1.6.2 to 1.6.3.

WHY:

Some WatchGuard Firebox traffic logs emit the log.duration field with a " seconds" suffix (e.g. "30 seconds" instead of "30"). The pipeline's existing convert processor (type: long) would fail on these values because it cannot parse a string containing non-numeric characters. When that happened, the on_failure handler removed the duration field entirely, losing the data, and appended an error message. By prepending a grok extraction step that isolates the numeric portion, the convert-to-long step now receives a clean number regardless of whether the source data includes the suffix, preserving the duration value in all cases without breaking the downstream seconds-to-nanoseconds conversion script.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

[elastic-vault-github-plugin-prod]

Reviewers

Buildkite won't run for external contributors automatically; you need to add a comment:

• /test : will kick off a build in Buildkite.

NOTE: https://github.com/elastic/integrations/blob/main/.buildkite/pull-requests.json contains all those details.

[elasticmachine]

Pinging @elastic/integration-experience (Team:Integration-Experience)

[taylor-swanson]

Could you add a pipeline test to show the new processor works, and as a regression test going forward?

[eset-122346]

Could you add a pipeline test to show the new processor works, and as a regression test going forward?

Done.

[taylor-swanson]

/test

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: a5c69df

[elastic-vault-github-plugin-prod]

Package watchguard_firebox - 1.6.3 containing this change is available at https://epr.elastic.co/package/watchguard_firebox/1.6.3/