Fix/refactor file output

This will need reviews, It used a similar behavior on failure than the grok filter.

should we log here with warning that we are switching to a different path?