[proposal] Deprecate Filebeat syslog input

[andrewkroh]

I propose we deprecate the Filebeat syslog input by adding a notice to the documentation that recommends switching inputs and applying the syslog processor. And we would also add a cfgwarn message to the code.

Why?

• Decouple inputs from the processing of the data. Keeping them separate allows for more configuration flexibility and better reuse of building blocks.
• There should not be two ways to do the same thing. The syslog input duplicates what the udp/tcp/unix inputs do plus adds syslog decoding which can be done with the syslog processor.
• Syslog input is not aligned to ECS (while the syslog processor is).

Related

• Create Syslog Processor #30139
• Verify and improve syslog input ECS compatibility #20029 (comment)

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[elasticmachine]

Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices)