Duplicate syslogs being delivered

The Syslog solution is clustered across our two datacentre's using a private link, so not active/standby in respects to the infrastructure utilized for the logging servers. So to ensure logs are still received from the remote peer (stand alone device) in the event of a public link failure it has two VPN's configured one to each DC, as a result duplicate logs are being registered within the logging system.

What I've been asked to confirm is can the F5 in each DC with a VServer with an IP specific to the range within its own DC, with the same pool members perform an upstream check for the VPN tunnel being available. Then have only one VServer active i.e. DC1 but when the VPN into DC1 is found to be down the VServer in DC2 become the active VServer.

Hope this doesn't muddy the water further than it already is.