[watchguard_firebox]: fqdn_src_match breaks traffic log parsing

### Integration Name

WatchGuard Firebox [watchguard_firebox]

### Dataset Name

pipeline_traffic.yml

### Integration Version

1.4.0

### Agent Version

9.0.3

### Agent Output Type

elasticsearch

### Elasticsearch Version

9.0.3

### OS Version and Architecture

docker on Ubuntu 24.04

### Software/API Version

_No response_

### Error Message

no error message, but parsing with the first grok processor is not working when having an fqdn match. Here the result Dok:

```
{
"docs": [
{
"doc": {
"_index": "_index",
"_version": "-3",
"_id": "_id",
"_source": {
"observer": {
"product": "Firebox",
"hostname": "fw01",
"serial_number": "801307B7639AD",
"type": "firewall",
"vendor": "WatchGuard"
},
"@timestamp": "2025-07-31T23:06:23.000Z",
"ecs": {
"version": "8.17.0"
},
"related": {
"hosts": [
"fw01"
]
},
"log": {
"syslog": {
"hostname": "fw01",
"appname": "firewall",
"priority": 142
}
},
"watchguard_firebox": {
"log": {
"log_type": "traffic",
"msg_id": "3000-0148",
"timestamp": "2025-07-31T21:06:23.000Z"
}
},
"event": {
"original": """<142>Jul 31 23:06:23 fw01 801307B7639AD (2025-07-31T21:06:23) firewall: msg_id="3000-0148" fqdn_src_match="srv01.lan.company.org" Allow WAN_IF SERVER_LAN 60 tcp 20 56 192.168.30.22 192.168.40.18 49058 10050 offset 10 S 664600296 win 61690 (INT_FWR_Monitoring-00)""",
"timezone": "UTC",
"kind": "event",
"category": [
"network"
],
"type": [
"connection"
],
"outcome": "success"
}
},
"_ingest": {
"timestamp": "2025-08-07T18:52:33.753182581Z"
}
}
}
]
}
```

### Event Original

```
"event": {
"original": """<142>Jul 31 23:06:23 fw01 801307B7639AD (2025-07-31T21:06:23) firewall: msg_id="3000-0148" fqdn_src_match="srv01.lan.company.org" Allow WAN_IF SERVER_LAN 60 tcp 20 56 192.168.30.22 192.168.40.18 49058 10050 offset 10 S 664600296 win 61690 (INT_FWR_Monitoring-00)""",
"timezone": "UTC",
"kind": "event",
"category": [
"network"
],
"type": [
"connection"
],
"outcome": "success"
}
```

### What did you do?

sending Syslog of Watchguard Firebox to the integration. When not having FQDNs in the firewall rules, all is working fine, but when having FQDNs in either source or destination that maches, parsing breaks.

### What did you see?

I see traffic log events, which have no real traffic fields like source.ip or destination.ip) filled in

### What did you expect to see?

correctly parsed

fields like when not having FQDNs in Rules (see picture)

### Anything else?

please find the whole simulation in verbose mode by sending in DEV Console the following command:

```
POST _ingest/pipeline/logs-watchguard_firebox.log-1.4.0/_simulate?verbose=true
{
"docs": [
{
"_source": {
"message": "<142>Jul 31 23:06:23 fw01 801307B7639AD (2025-07-31T21:06:23) firewall: msg_id=\"3000-0148\" fqdn_src_match=\"srv01.lan.company.org\" Allow WAN_IF SERVER_LAN 60 tcp 20 56 192.168.30.22 192.168.40.18 49058 10050 offset 10 S 664600296 win 61690 (INT_FWR_Monitoring-00)"
}
}
]
}
```

[console_export.txt](https://github.com/user-attachments/files/21671709/console_export.txt)

And here the output, when no FQDN matching happens with the command:

```
POST _ingest/pipeline/logs-watchguard_firebox.log-1.4.0/_simulate?verbose=true
{
"docs": [
{
"_source": {
"message": "<142>Jul 31 23:06:23 fw01 801307B7639AD (2025-07-31T21:06:23) firewall: msg_id=\"3000-0148\" Allow WAN_IF SERVER_LAN 60 tcp 20 56 192.168.30.22 192.168.40.18 49058 10050 offset 10 S 664600296 win 61690 (INT_FWR_Monitoring-00)"
}
}
]
}
```

[console_export (1).txt](https://github.com/user-attachments/files/21671749/console_export.1.txt)