I think [this comment in logstash is revealing](https://github.com/elasticsearch/logstash/blob/1.3.x/lib/logstash/inputs/syslog.rb#L17) 
```
Of course, 'syslog' is a very muddy term. This input only supports RFC3164
```

With the change you are proposing; we're actually just accepting anything on a TCP/UDP socket, and then calling it `syslog`

I think we should actually be adding a new `ingestor_tcp`, and possibly rename this one to `ingestor_syslog_RFC3164`

What do you think?