Is your feature request related to a problem? Please describe.
Fluent Bit’s syslog input plugin currently supports TCP syslog with newline (\n) framing, but does not support RFC 6587 octet-counting framing. This limits interoperability with enterprise systems that only implement octet counting.

Many commercial appliances, firewalls, and legacy systems only implement octet counting (e.g., Cisco, Palo Alto, some Windows syslog agents).

Without octet counting, Fluent Bit cannot directly integrate with these sources.

Describe the solution you'd like
Proposed Solution

Extend Fluent Bit’s syslog input plugin to support RFC 6587 framing with an optional config parameter (similar to Fluentd’s frame_type octet_count).
Example:

[INPUT]
    Name   syslog
    Mode   tcp
    Listen 0.0.0.0
    Port   5140
    Frame  octet_counting   # <-- new option

Describe alternatives you've considered
Today, users must insert an extra component (Fluentd, Logstash, or a custom TCP proxy) just to handle octet-counted syslog.

This increases operational complexity, resource usage, and potential points of failure. It also weakens Fluent Bit’s positioning as a standalone lightweight log forwarder.

Additional context

Key value of this feature:

Aligns Fluent Bit with syslog standards (RFC 6587).
Eliminates dependency on Fluentd or external proxies for many enterprise use cases.
Improves reliability by reducing infrastructure complexity.
Increases Fluent Bit adoption in syslog-heavy environments where lightweight, single-agent architecture is preferred.

This is not just a “nice-to-have”, but a standards gap that limits Fluent Bit adoption in enterprise syslog-heavy environments.