This article explains the issue with TCP syslog from SRX to JSA.

SRX will send multiple syslog payloads to JSA in a single packet if you use TCP syslog. However, as per the article Security log stream using TCP protocol, it is expected from the SRX and we can't change it.

JSA will only parse the first payload received in the TCP syslog packet.

The SRX uses Octet Counting framing for TCP syslog which JSA does not support. JSA supports Non-Transparent-Framing for TCP syslog. There are two options to resolve the issue, 1) Use udp syslog which uses Non-Transparent-Framing, or 2) Use TLS Syslog which supports Octet Counting.