Parse tab-separated fields in Logstash

With Logstash's default config.support_escapes: false, the text \t in a quoted configuration string is not converted to a tab. For the CSV filter, put an actual tab character between the separator quotes.

Use a literal tab

The separator below contains one tab, not spaces:

input {
  file {
    path => "/var/data/*.tsv"
    start_position => "beginning"
  }
}
filter {
  csv {
    separator => "	"
    columns => ["time", "level", "message_text"]
    target => "record"
  }
}
output {
  stdout { codec => rubydebug }
}

Enable whitespace markers in your editor and confirm it does not replace the tab with spaces. Use a sample record with exactly the columns you expect, including a quoted value containing a tab when that is part of your input format.

Alternatively, enable escape processing

In logstash.yml:

config.support_escapes: true

Then this filter uses a tab separator:

filter {
  csv {
    separator => "\t"
    columns => ["time", "level", "message_text"]
    target => "record"
  }
}

This setting changes escape handling throughout quoted configuration strings. Review other backslashes before enabling it in an established pipeline. Without it, the same separator spelling represents a backslash followed by t, so it will not parse ordinary TSV as intended.

Headers, quotes, and repeatable tests

The CSV filter supports quoted fields through quote_char, whose default is a double quote. Without explicit columns, generated names include column1 and column2. If using autodetect_column_names => true, set pipeline.workers: 1; header skipping also has this single-worker requirement.

For repeatable Unix file tests, use a dedicated input with sincedb_path => "/dev/null" and restart the test process. That setting does not replay content continuously during one run.

Grok can recognize tabs through regex syntax, while dissect and mutate split use delimiter strings. Do not assume "\t" becomes a tab in every plugin under default configuration settings. Choose CSV when quoting rules matter, and inspect the resulting fields before adding your production output.

References

• Elastic: filters csv
• Elastic: logstash settings file
• Elastic: inputs file