ASM Logging Best Practices

TCP is best if you need to make sure you don't lose any log data (a requirement in the financial sector for example).

Re: format etc. - all depends on the destination SIEM system where you send the logs. If you send your logs to Splunk for example (seems to be a popular choice these days) - there is a good article explaining the formatting of the fields and other settings here:

https://docs.splunk.com/Documentation/AddOns/released/F5BIGIP/Setup

I hope this helps