Firewall Logpush - Allow filter for action

I’d like to be able to filter logs sent to SIEM/Datadog by excluding logged actions for testing. So send everything but action=log. Is this a large lift?