filter {
  grep {
    regex => /abcd/
    invert => true
  }
}

output {
  file {
    path => output.txt
    serializer => json_logstash
  }
}