For those of you that do this with OPNsense what level of logging are you sending to your remote server? I am in the beginning stages of deploying Graylog and do not want to send too much over.
As long as you're not flooding your local syslog with default block firewall logs, squid, resolver, etc you should be g2g to log all facility's to your remote syslog.
But as always it all depends on what logs you find important enough to keep in your environment and what resources (network/disk io) you can "spare" .
I would suggest logging over TCP unless you are looking into "physically" seperating your log server by disabling Tx on hardware level.
Hope this helps.