I work for the company that is developing SIEM solution for last 5 years, so I constantly have to talk to new and existing clients, helping them pick best way to integrate what we offer.
What comes to my mind about SIEM and pre-filtering is if you need to keep your logs intact when entering system because of various country regulations. This might or might not be important for your company.
Secondly, if your SIEM offers $$ plan that concentrates on stored data and not data transferred, you might filter what actually enters storage (retention level, pre-indexing part) so you don't spend too much storage space and you dont kill SIEM alerting with too much junk data. Configuring what enters SIEM and what is discarded at SIEM level and not on OS level gains you more control on what happens if someone quits, you change OS or similar. Look at SIEM rules as documentation for your infrastructure. If it is all in one place it is easier to look at then if its distributed at non standard places.
I would collect everything and make few rules in retention level so data does not enter indexing level (alerting, correlation etc). If there are regulatory compliances you must follow i would just leave like it as is.