If you want to filter out 'early' in filebeat there is an exclude/include_lines option in filebeat. Potential pattern can be ' [.+] INFO - ' to capture INFO log-level messages. This is some pre-filtering support to reduce network usage. Logstash provides additional parsing + filtering capabilities.