Kiwi Syslog multi-site design

I have a small environment that is being required(regulated) to gather and store Windows Server and Cisco FW logs.  We currently have two sites with servers.  Whats the best practice to get High Availability of log collection without killing WAN link.  I was thinking that you can have every server send logs to a log collector at each site, Is this best practice?

Thanks,

JimBob