[Fortinet Fortigate]: Consistently malformed field "dstip" in Kerberos authentication causes pipeline error

### Integration Name

Fortinet FortiGate Firewall Logs [packages/fortinet_fortigate]

### Dataset Name

fortinet_fortigate.log

### Integration Version

1.34.0

### Agent Version

9.3.5

### Agent Output Type

logstash

### Elasticsearch Version

9.3.5

### OS Version and Architecture

Docker

### Software/API Version

_No response_

### Error Message

Pipeline error when processing dstip (invalid value).

### Event Original

<189>date=2026-06-26 time=08:18:46 devname="devicename" devid="serial" eventtime=1782461925933112424 logid="0102043025" type="event" subtype="user" level="notice" vd="root" logdesc="Explicit proxy authentication successful" srcip=123.123.123.123 dstip=authid="aaa-rl_http-krb" user="someuser" authproto="HTTP(123.123.123.123)" action="NEGO-auth" status="success" reason="Authentication succeeded" msg="User someusersucceeded in authentication"

### What did you do?

Created a bugfix pipeline that's patched into the main integration that gsubs this pattern and replaces it with a sanitized version, dropping the empty dstip.

{
"gsub": {
"pattern": "dstip=authid=",
"tag": "dstip_bugfix",
"field": "syslog5424_msg",
"replacement": "authid="
}
}

### What did you see?

Fortigate consistently sends malformed logs in Kerberos authentication events. This causes the Fortigate integration to fail.
Note the missing space between dstip= and authid=.

### What did you expect to see?

A guardrail for this behavior.

### Anything else?

_No response_