Comment by Narkov

> There's really not a reason to ship or index logs.

Proper Information Security policy is one very good reason. If a box is compromised, you don't want the logs being tampered with.

You ship the logs to a central, dedicated server so that a clear audit trail can be established.