With the syslog input plugin, allow selection of protocol – tcp or udp or both.
Currently, it automatically does both and cannot be changed.
We'll be adding a 'udp' input plugin soon to help with this. The syslog input is going away in the future, so I don't think we'll be improving it.
If all you need right now is TCP input, though, you should use just the tcp input.
marking wontfix for reasons above