Fix/refactor file output

This will need reviews, It used a similar behavior on failure than the grok filter.

can we call this field_ref_path or path_with_field_ref to be more clear?