That's a lot of machines. See the discussion here: Filtering Winlogbeat Events
Summarizing that thread, a filtering feature is being added to all beats. Relevant here is drop_event in the proposal. Additionally there is a request for using XPath queries in Winlogbeat, but that's further out (#1053 is first in line).
At the current time you need to use Logstash to do filtering.