[Filebeat] rfc6587 framing for fortinet firewall (elastic#23837)

- use rfc6587 framing when transferring fortinet firewall logs via
  syslog over TCP
- use rfc6587 framing when transferring fortinet clientendpoint logs
  via syslog over TCP

CHANGELOG.next.asciidoc

@@ -377,6 +377,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Fix concurrent modification exception in Suricata ingest node pipeline. {pull}23534[23534]
 - Fix Zoom module parameters for basic auth and url path. {pull}23779[23779]
 - Fix handling of ModifiedProperties field in Office 365. {pull}23777[23777]
+- Use rfc6587 framing for fortinet firewall and clientendpoint filesets when transferring over tcp. {pull}23837[23837]
 - Fix goroutines leak with some inputs in autodiscover. {pull}23722[23722]
 - Fix various processing errors in the Suricata module. {pull}23236[23236]
 

x-pack/filebeat/module/fortinet/clientendpoint/config/input.yml

@@ -7,7 +7,13 @@ paths:
   {{ end }}
 exclude_files: [".gz$"]
 
-{{ else }}
+{{ else  if eq .input "tcp" }}
+
+type: {{.input}}
+host: "{{.syslog_host}}:{{.syslog_port}}"
+framing: rfc6587
+
+{{ else  if eq .input "udp" }}
 
 type: {{.input}}
 host: "{{.syslog_host}}:{{.syslog_port}}"

x-pack/filebeat/module/fortinet/firewall/config/firewall.yml

@@ -2,6 +2,7 @@
 
 type: tcp
 host: "{{.syslog_host}}:{{.syslog_port}}"
+framing: rfc6587
 
 {{ else if eq .input "udp" }}