Summary

Adds a new syslog sink that sends log events in syslog format (RFC 5424 or RFC 3164) over TCP, UDP, TCP with TLS, or Unix stream sockets.

This wraps Vector's existing socket transport utilities (TcpSinkConfig, UdpSinkConfig, UnixSinkConfig) with the syslog serializer from #23777/#24662. Syslog-specific options (rfc, facility, severity, app_name, proc_id, msg_id) are exposed under syslog for a first-class configuration experience.

The sink supports stream framing for TCP and Unix stream transports:

• newline_delimited for RFC 6587 non-transparent framing.
• octet_counting for RFC 6587 octet-counting framing.
• TCP + TLS + RFC 5424 + octet_counting for RFC 5425 syslog over TLS.

This also hardens the syslog serializer for enterprise interoperability:

• Sanitizes RFC 5424 header fields and uses NILVALUE for empty invalid header fields.
• Normalizes structured-data names and avoids invalid empty SD names.
• Accepts common facility/severity aliases and numeric strings used by rsyslog/syslog-ng/syslog decoders.
• Rejects non-log events defensively instead of emitting an empty octet-counted frame.

Thanks to @vparfonov, @polarathene, and @syedriko for the syslog encoder work in #23777 that made this possible.

Vector configuration

TCP (RFC 5424):

sinks:
  my_syslog:
    type: syslog
    inputs:
      - my_source
    mode: tcp
    address: syslog.example.com:514
    syslog:
      rfc: rfc5424
      app_name: .app_name
      facility: .facility
      severity: .severity

UDP (RFC 3164):

sinks:
  my_syslog:
    type: syslog
    inputs:
      - my_source
    mode: udp
    address: syslog.example.com:514
    syslog:
      rfc: rfc3164

TCP with TLS (RFC 5425):

sinks:
  my_syslog:
    type: syslog
    inputs:
      - my_source
    mode: tcp
    address: syslog.example.com:6514
    tls:
      enabled: true
      ca_file: /path/to/ca.pem
    framing:
      method: octet_counting
    syslog:
      rfc: rfc5424

Unix stream socket:

sinks:
  my_syslog:
    type: syslog
    inputs:
      - my_source
    mode: unix_stream
    path: /path/to/syslog.sock

How did you test this PR?

Unit tests cover all transport modes, both RFC formats, custom PRI fields, TCP/TLS octet-counting, UDP datagram behavior, Unix stream delivery, and component compliance.

Codec tests cover RFC 5424/3164 formatting, PRI alias parsing, numeric PRI parsing, RFC 5424 header field sanitization, structured-data escaping, structured-data name truncation, empty-name handling, and non-log event rejection.

Validation commands run:

• rustup run 1.92 cargo test -p codecs --features syslog --lib encoding::format::syslog::tests::
• rustup run 1.92 cargo test --no-default-features --features sinks-syslog -p vector --lib sinks::syslog
• rustup run 1.92 cargo check --no-default-features --features sinks-syslog -p vector --lib
• make check-clippy
• make check-markdown
• ./scripts/cue.sh vet
• ./scripts/check_changelog_fragments.sh
• git diff --check

Change Type

• New feature
• Bug fix
• Dependencies
• Non-functional (chore, refactoring, docs)
• Performance

Is this a breaking change?

• Yes
• No

Does this PR include user facing changes?

• Yes. Changelog fragment added.
• No.

References

• Closes: New syslog sink #6863
• Related: feat(codecs): Add syslog encoder #23777 (syslog encoder codec)
• Related: enhancement(codecs): advanced syslog Structured Data & RFC compliance fixes #24662 (syslog encoder follow-up)

Notes

• Encoding is fixed to syslog. Users who need configurable encoding, field filtering, or timestamp formatting can use the socket sink with encoding.codec = "syslog".
• Newline-delimited stream framing can split multiline messages. Use framing.method = "octet_counting" when messages can contain embedded newlines, such as stack traces or multiline JSON.
• RFC 5425 requires octet-counting. For syslog over TLS compliance, use TCP, TLS, RFC 5424, and framing.method = "octet_counting".
• RFC 3164 timestamps are emitted in UTC. This is documented rather than changed to local time for the initial sink to avoid host-local timezone ambiguity.
• Unix socket support is stream-only. Unix datagram sockets, including typical Linux /dev/log sockets, are not supported by this sink. Use the socket sink with mode = "unix_datagram" for that case.
• Message length policy is intentionally out of scope for v1. The sink currently sends the serialized event as produced by the codec and transport. A future max_message_length policy should define truncate/drop behavior, internal events/metrics, and transport-specific guidance.

Intentionally out of scope for this initial implementation

Please do not block this PR on these items unless maintainers want to expand scope:

• No max-message-length truncate/drop policy yet.
• No Unix datagram (/dev/log) mode in this dedicated sink.
• No RELP, batching, compression, disk-spool-specific semantics, or syslog aggregator behavior.
• No RFC 5424 UTF-8 BOM toggle.
• No promotion of octet-counting into the shared codec framing layer.
• No TLS hostname-verification integration test beyond the existing Vector TLS plumbing and the RFC5425 wire-format test.