The management plane appliance can upload logs directly through the UI, and both the management plane appliance and log parser appliances can also receive them via SFTP, SCP, and FTPS.
Log uploads are disabled by default on new appliances. To process logs, run the command set log-upload enable true. If log uploads are already running on an existing appliance, you can disable log processing by running the command set log-upload enable false. If an appliance is not being used for log parsing, run the command set log-upload enable false.