Use the Winlogbeat Beats agent. You can specify which logs and event IDs you'd like to have sent over.
https://www.elastic.co/guide/en/beats/winlogbeat/current/configuration-winlogbeat-options.html
winlogbeat.event_logs:
- name: Security
event_id: 4624, 4625, 4700-4800, -4735