Guide: Integrating SRX logs with a SIEM (Splunk, Elastic) without Log Director.

Everyone overcomplicates this. You don't need Log Director. It's just another box to manage and license.

Basic syslog forwarding works. Configure your SRX to send structured data directly to your SIEM's ingestion endpoint.

* Set your SIEM server as a syslog host.
* Use `structured-data` for better parsing.
* Filter the event types you actually need. Don't just send everything.

```
set system syslog host any any
set system syslog host structured-data
set system syslog host explicit-priority
set system syslog host firewall
```

On the SIEM side (e.g., Splunk Heavy Forwarder, syslog-ng, Elastic Agent), parse the RFC 5424 format. Use a props.conf or ingest pipeline to extract the structured fields.

The complexity is in the SIEM parsing config, not the SRX. Keep the source simple.