Availiable actions for _grokparsefailure (drop, mutate, ...) - need _grokparsefailure events in a separate file

[jiona]

For further analysis I need only _grokparsefailure events in a separate file.
I thought instead of "drop" I could use "file" (like in the output section) but it doesnt work.
How can I do that or where can I find more information and explanationd about options for "_grokparsefailure"?

Kind regards
Jiona

[Badger]

You can make the output conditional.

Something like

output {
    if "_grokparsefailure" in [tags] {
         file {
             ...
         }
    } else {
        ...some other output...
    }
}

[jiona]

Looks good. That's my conditional output.
Now I need to wait until tomorrow

  else if [type] == "syslogdect500" {
    if "_grokparsefailure" in [tags] {
        file {"path" => "/tmp/gork_dect500_failure.txt"}
    }
    else {
        elasticsearch {
        hosts => ["*****:9200"]
        user => "*****"
        password => "*****"
        index => "syslogdect500-%{+YYYY.MM}"
        }
        #stdout { codec => rubydebug }
    }
  }

Kind regrads
Jiona