Nodes can greatly vary with how much data they're sending especially as you can change the amount of log data by logging at different log levels (informational vs warning, etc).
You can find information about retention and reporting in the LEM here:
Live Data Storage Retention in LEM - SolarWinds Worldwide, LLC. Help and Support
In your case, unless the firewall is very active, you may be able to get away with the default small deployment (2 core, 8 GB of RAM, 250 GB of Disk). The disk size may actually retain much more than a month worth of data, but unless there's some other restriction in your environment it can be a bit of a task to shrink the drive size (Resize a LEM Virtual Appliance - SolarWinds Worldwide, LLC. Help and Support )
For truly measuring the logs received and retention you'll want to use nDepth to show you all events in the last week to get an idea of logs per day and use the Database Maintenance Report to review the actual number of days of data you have in your database as well as daily logs received for scaling.