output {
  if [message] != "abcd" {
    file {
      path => output.txt
      serializer => json_logstash
    }
  }
}