This is a meta-issue to link / discuss impending changes to the syslog input. The syslog input has been in beta for a long time, and GA is gated in part on supporting RFC 5424 (currently we only support the older RFC 3164). Thanks to an external contribution from @wph95 we have most of what we need for the base implementation, and the rest is largely logistics and testing. Here is the current tracking list, and this issue can be used to add or discuss prerequisites for proceeding:

• Merge the external PR that adds support for RFC 5424 (Add RFC5424 format support for syslog input  #23954)
• Add documentation / changelog for the new settings ([filebeat] Update documentation / changelog / beta warnings for the syslog input #25047)
• Clarify the documentation / logs around the syslog input being in beta ([filebeat] Update documentation / changelog / beta warnings for the syslog input #25047)
  • We probably want to stay in beta for the initial release after adding RFC 5424, so we should make sure that's clear
• Live testing with multiple syslog versions We do not need this, too many variants (@ph, @urso)
  • syslog-ng only add issue for test plan?
• Backport all PRs to the release target (7.13?)
• Advance to GA ([Filebeat] Bring syslog input to GA #24729)