To apply custom filter before forwarding audit logs externally

1. Proposed title of this feature request

To apply custom filter before forwarding the audit logs externally

2. What is the nature and description of the request?
To have customer filters for audit logs like:
Events FILTER1: to get user action events (non system) from audit* index
NOT (user.username:system)

Events FILTER2: to get login/logout events from audit* index.
objectRef.resource:oauthaccesstokens

3. Why does the customer need this? (List the business requirements here)
Collecting the complete audit logs consuming more space and taking more network bandwidth while pushing all audit logs externally most of which are actually not required.