destination tlsLogServer {
  syslog(
    10.0.0.10

    disk_buffer(
      disk_buf_size(256MiB)
      mem_buf_size(16MiB)
      reliable(no)
    )

    transport(tls)
    tls(
      ca_dir(/etc/syslog-ng/ca.d/)

      cert_file(/etc/syslog-ng/client.crt)
      key_file(/etc/syslog-ng/client.key)

      ciphers(ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:AES256-GCM-SHA384:AES256-SHA256:AES128-GCM-SHA256:AES128-SHA256:DHE-DSS-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA256:DHE-DSS-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:DHE-DSS-AES128-SHA256)
      ecdh_curve_list(secp256k1:secp384r1:secp521r1)
      peer_verify(require_trusted)
      ssl_options(no_sslv2, no_sslv3, no_tlsv1)
    );
  );
};

log { source(local); destination(tlsLogServer); };