[fortinet_fortigate] Add deltabytes field, ensure rcvddelta and sentdelta fields are integers

[taylor-swanson]

Proposed commit message

• Changed rcvddelta and sentdelta fields to long type, added convert processors
• Added new fortinet.firewall.deltabytes field, which is the sum of the rcvddelta and senddelta fields

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

cd packages/fortinet_fortigate
elastic-package test

Related issues

• Closes [Fortinet Fortigate Traffic]: Wrong calculation of network.bytes #10849
• Closes [Fortinet FortiGate Firewall Logs]: rcvddelta and sentdelta are keywords as opposed to integers #11433

[elasticmachine]

Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices)

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 53ccf4c

History

• 💚 Build #25094 succeeded 1bc27a2
• 💔 Build #25090 failed 1844224

cc @taylor-swanson

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[elastic-vault-github-plugin-prod]

Package fortinet_fortigate - 1.32.0 containing this change is available at https://epr.elastic.co/package/fortinet_fortigate/1.32.0/

[leandrojmp]

Hello @taylor-swanson,

This change should've been marked as breaking-change, not just enhancement, this introduced a conflict in Kibana, now the fields fortinet.firewall.sentdelta and fortinet.firewall.rcvddelta cannot be used anymore in Kibana until the conflict is solved.

For example, this would break any custom security rule that where using those fields.

I personally wasn't using it, but I keep fortigate logs for 90 days including frozen, I will need to wait at least 90 days for the conflict to be fixed.

The conflict in Kibana:

ES|QL breaks because of the conflict:

[taylor-swanson]

@leandrojmp,

I would agree with your assessment. Also good to see that discussion pop up around the same time. Any further discussions on the issue should go there, just so all the conversations can be kept together.

Version handling in Kibana is a bit rough right now. Even with making it a breaking change, this isn't called out to the user very well (if at all), and unless someone was paying attention, they might click through anyway and end up in the same situation. I don't have the issue handy, but word is that the Kibana team is improving this experience (calling out breaking changes).

I do apologize for the breakage, it certainly wasn't my intention with this change.

Edit: Kibana issues were called out in this comment.