Thanks all,
It was the config on the SRX in the end;
set security log mode stream
set security log format sd-syslog
set security log source-address x.x.x.x
set security log stream securitylog format welf
set security log stream securitylog host x.x.x.x
set security log stream hostx.x.x.x format welf
set security log stream hostx.x.x.x host x.x.x.x
set security log stream logcollector format syslog
set security log stream logcollector host x.x.x.x
set security log stream logcollector format sd-syslog
set security log stream logcollector host port 514
set security log stream logcollector category all