For the most part you should be able to take the script from your AO and use that.
Instead of an alarm structure, the preprocessing script will already have a variable named "event" that contains the message.
There are restrictions on the functions you can use in a preprocessing script but the file IO calls appear to be allowed.
At the end of the script return nil and the event will be discarded.
Only one preprocessing script will match an event - so if you have multiple scripts care needs to be taken that there's no overlap in the matching criteria or you need to duplicate script content.
Preprocessing fires on every message so if you're capturing something like a CDM message that is sent every interval, you'll fire the preprocessing script on every message - as opposed to an AO profile where you might be using count or overdue age to limit executions.
And as an aside, you'll get much better answers if you include detail about what you are trying to achieve and work you've already done. There may well be a much better approach to your final goal than this preprocessing idea but without knowledge of that goal, it's hard to say. Answering why you are required to write some data to a file might result in a better answer.