[watchguard_firebox]: "msg_id=3E00-0004" and "msg_id=3E00-0004" are failing to grok "watchguard_firebox.log.body" while user type is SSL VPN user or user contains "-"

### Integration Name

WatchGuard Firebox [watchguard_firebox]

### Dataset Name

watchguard_firebox.log

### Integration Version

1.5.0

### Agent Version

8.17.2

### Agent Output Type

elasticsearch

### Elasticsearch Version

8.17.2

### OS Version and Architecture

Debian 12

### Software/API Version

_No response_

### Error Message

No error present, it doesn't match the grok and does nothing.

### Event Original

`<150>Nov 20 01:35:58 Member1 M390-TEST-TEST-CPD (2025-11-20T00:35:58) sessiond[3091]: msg_id="3E00-0004" SSL VPN user test@AuthPoint from 175.62.29.200 logged out assigned virtual IP is 192.168.1.2`

`<150>Nov 20 01:35:28 TEST_1_TEST TEST sessiond[2818]: msg_id="3E00-0002" SSL VPN user test-test@Firebox-DB from 192.168.1.1 logged in assigned virtual IP is 192.168.1.2`

### What did you do?

Debian Server with Watchguard integration, watchguard firewall sends the syslog to the integration

### What did you see?

When a message contains "SSL VPN user" or a username with "-" it fails to grok "the watchguard_firebox.log.body".
The problem is caused by the %{IP:watchguard_firebox.log.virtual_ip} it's expecting an ip after the "logged in" string, however there is text instead and the ip is provided later in the message.

Also, the %{USER:watchguard_firebox.log.user_name} doesn't admit "-" and a patern definition is needed.

### What did you expect to see?

The fields extracted from the grok expression

### Anything else?

We had this workaroud that is working for 3E00-0002:

```
"grok": {
"ignore_failure": true,
"field": "watchguard_firebox.log.body",
"patterns": [
"^%{DATA:watchguard_firebox.log.user_type} %{USER:watchguard_firebox.log.user_name}(?:@%{DATA:watchguard_firebox.log.authentication_server})? from %{IP:watchguard_firebox.log.ip_address} logged in(?: %{IP:watchguard_firebox.log.virtual_ip} %{GREEDYDATA:watchguard_firebox.log.message})?$",
"^%{DATA:watchguard_firebox.log.user_type} %{USER:watchguard_firebox.log.user_name}(?:@%{DATA:watchguard_firebox.log.authentication_server})? from %{IP:watchguard_firebox.log.ip_address} logged in(?: %{GREEDYDATA:watchguard_firebox.log.message} %{IP:watchguard_firebox.log.virtual_ip})?$"
],
"tag": "grok_for_message_id_3E00-0002",
"pattern_definitions": {
"USER": "[A-Za-z0-9._-]+"
},
"if": "ctx.watchguard_firebox.log.msg_id != null && ['3E00-0002'].contains(ctx.watchguard_firebox.log.msg_id)"
}
```

and this one for 3E00-0004:

```
"grok": {
"ignore_failure": true,
"field": "watchguard_firebox.log.body",
"patterns": [
"^%{DATA:watchguard_firebox.log.user_type} %{USER:watchguard_firebox.log.user_name}(?:@%{DATA:watchguard_firebox.log.authentication_server})? from %{IP:watchguard_firebox.log.ip_address} logged out(?: %{IP:watchguard_firebox.log.virtual_ip} %{GREEDYDATA:watchguard_firebox.log.message})?$",
"^%{DATA:watchguard_firebox.log.user_type} %{USER:watchguard_firebox.log.user_name}(?:@%{DATA:watchguard_firebox.log.authentication_server})? from %{IP:watchguard_firebox.log.ip_address} logged out(?: %{GREEDYDATA:watchguard_firebox.log.message} %{IP:watchguard_firebox.log.virtual_ip})?$",
"^%{DATA:watchguard_firebox.log.user_type} %{USER:watchguard_firebox.log.user_name}(?:@%{DATA:watchguard_firebox.log.authentication_server})? from %{IP:watchguard_firebox.log.ip_address} logged out(?:%{GREEDYDATA:watchguard_firebox.log.message})?$"
],
"tag": "grok_for_message_id_3E00-0004",
"pattern_definitions": {
"USER": "[A-Za-z0-9._-]+"
},
"if": "ctx.watchguard_firebox.log.msg_id != null && ['3E00-0004'].contains(ctx.watchguard_firebox.log.msg_id)"
}
```

In both cases, the first grok pattern is the original but with USER instead of WORD for watchguard_firebox.log.user_name. The other ones are the needed to work.

Please, test it, it's working in our environment for only few days