Just to close the issue out, finally got it working.
What I did originally was setup a routing-instance that had the static route to the 192.168 network via the 0/1/9 interface. Then the firewall rule which was looking for and allowing the SYSLOG messages out of the MX was "then routing-instance OUT_SYSLOG". That apparently doesn't work the same as it does on an SRX.
What I ended up doing was change the firewall filter to a simple accept and then created a static route globally for the 192.168 using the 0/1/9 interface. Once that was done, the SYSLOG messages started showing up on the SIEM - yeah!
Now it's just tuning and setting up the baseline.
Thanks for the assist!!!
