Fix/refactor file output

This will need reviews, It used a similar behavior on failure than the grok filter.

not sure if we need to tag all events if they are ending up in a sanitized file anyways?