This article provides the configuration information needed to send logs in stream mode from non-root logical systems (LSYS).

 We want to send policy logs for traffic going though a non-root LSYS.

Starting in Junos OS release 18.3R1, traffic logs from non-root LSYS can be directly sent via non-root LSYS interface using following configuration. In this case the syslog server (192.168.4.2) is directly reachable through non-root LSYS interface.

logical-systems {
    INET {
        security {
            log {
                mode stream;
                format sd-syslog;
                source-address 192.168.4.1;
                stream trafficlogs {
                    format sd-syslog;
                    category all;
                    host {
                        192.168.4.2;
                        routing-instance inet-vr;
                    }
                }
            }
        }
   }

For other Junos OS versions, logs can only be sent from a non-root LSYS if the syslog server is reachable through a root LSYS.  You will need to connect the root LSYS and custom LSYS through an interconnect LSYS.  You will also need to provide a route for syslog server through the lt-0/0/0 interface connecting the two LSYS. The configuration will be as follows (note, only relevant snippets are shown):

## Configuration on non-root LSYS
logical-systems {
    INET {
        interfaces {
            lt-0/0/0 {
                unit 3 {
                    encapsulation ethernet;
                    peer-unit 2;
                    family inet {
                        address 10.0.1.2/24;
                    }
                }
            }
        routing-instances {
            inet-vr {  
                routing-options {
                   static {
                       ## 192.168.4.2 is the IP address of syslog server which is reachable through root LSYS
                       route 192.168.4.2/32 next-hop 10.0.1.1; 
            }
        }
    }
}

## Configuration on Interconnect LSYS
    interconnect-logical-system {
        interfaces {
            lt-0/0/0 {
                unit 0 {
                    encapsulation ethernet-vpls;
                    peer-unit 1;  ## connects to root LSYS lt-0/0/0 interface
                }
                unit 2 {
                    encapsulation ethernet-vpls;
                    peer-unit 3;  ## connects to non-root LSYS lt-0/0/0 interface

                }
            }
        }
        routing-instances {
            vr-ic {
                instance-type vpls;
                interface lt-0/0/0.0;
                interface lt-0/0/0.2;
            }
        }
    }
}

## Configuration on root-LSYS
interfaces {
    lt-0/0/0 {
        unit 1 {
            encapsulation ethernet;
            peer-unit 0;
            family inet {
                address 10.0.1.1/24;
            }
        }
    }


security {
    log {
        mode stream;
        format sd-syslog;
        source-address 192.168.4.1;
        stream trafficlogs {
            format sd-syslog;
            category all;
            host {
                192.168.4.2;
            }
        }
    }
}

Verification:

To verify, check the security flow session for the logs:

root@1400-1# ...w security flow session protocol udp logical-system INET    
node0:
--------------------------------------------------------------------------

Flow Sessions on FPC1 PIC0:

Session ID: 20000002, Policy name: any-out/4, State: Active, Timeout: 58, Valid
  In: 192.168.4.1/514 --> 192.168.4.2/514;udp, If: lt-0/0/0.3, Pkts: 10, Bytes: 7011
  Out: 192.168.4.2/514 --> 192.168.4.1/514;udp, If: reth1.21, Pkts: 0, Bytes: 0
Total sessions: 1

{primary:node0}[edit]
root@1400-1# 
root@1400-1# ...w security flow session protocol udp logical-system INET    
node0:
--------------------------------------------------------------------------

Flow Sessions on FPC1 PIC0:

Session ID: 20000002, Policy name: any-out/4, State: Active, Timeout: 60, Valid
  In: 192.168.4.1/514 --> 192.168.4.2/514;udp, If: lt-0/0/0.3, Pkts: 11, Bytes: 7711
  Out: 192.168.4.2/514 --> 192.168.4.1/514;udp, If: reth1.21, Pkts: 0, Bytes: 0
Total sessions: 1

2019-04-28: Updated to reflect change starting in Junos 18.3r1