Add panw.panos.endreason field (#18705) (#20531)

PANW firewalls expone why a session is ended (endreason). Currenlty it's not tracked.
End reason is important to track down why a specific session is ended (timeout, rst from client/server...). This adds panw.panos.endreason.

Co-authored-by: Andrea Dainese <andrea.dainese@gmail.com>
Co-authored-by: Adrian Serrano <adrisr83@gmail.com>
(cherry picked from commit 6c0c3bf)

Co-authored-by: dainok <andrea.dainese@pm.me>

CHANGELOG.next.asciidoc

@@ -76,6 +76,7 @@ field. You can revert this change by configuring tags for the module and omittin
 - Adds Gsuite Groups support. {pull}19725[19725]
 - Move file metrics to dataset endpoint {pull}19977[19977]
 - Disable the option of running --machine-learning on its own. {pull}20241[20241]
+- Tracking session end reason in panw module. {pull}18705[18705]
 
 *Heartbeat*
 

filebeat/docs/fields.asciidoc

@@ -105249,6 +105249,16 @@ type: long
 
 --
 
+*`panw.panos.endreason`*::
++
+--
+The reason a session terminated.
+
+
+type: keyword
+
+--
+
 [float]
 === network
 

x-pack/filebeat/module/panw/panos/_meta/fields.yml

@@ -61,6 +61,11 @@
               description: >
                 Post-NAT destination port.
 
+    - name: endreason
+      type: keyword
+      description: >
+        The reason a session terminated.
+
     - name: network
       type: group
       description: >

x-pack/filebeat/module/panw/panos/config/input.yml

@@ -101,6 +101,7 @@ processors:
         source.packets: 44
         server.packets: 45
         destination.packets: 45
+        panw.panos.endreason: 46
         observer.hostname: 52
 
   - extract_array: