Machine data takes a lot of space, depending on how long you need/want to hold onto it - any given even might only be a few 100 bytes, but with 1000s or 10s of 1000s of devices sending even syslog turns into a metric buttload of data :)