A Heavy Forwarder would be needed to do any filtering of data at the source. Otherwise you could do the filtering at the indexer side.
You could handle it like you would if you were trying to anonymize data, like when you mask a credit card number or other PII (Personally Identifiable Information). In that scenario, you are basically breaking the data into pieces, then concatenating it back together, replacing a piece of the data with X's or #'s, masking part of it.
In your scenario, you could use the same method, but instead of replacing some of the data with another character, you just concatenate the data you want, leaving out the data you don't want.
Take a look at this documentation on anonymizing data:
http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Anonymizedatausingconfigurationfiles
