# Logstash Tab / Space Delimiter **URL:** \ **Category:** Logstash\ **Created:** [January 31, 2024, 9:09pm UTC](https://discuss.elastic.co/t/logstash-tab-space-delimiter/352231 "2024-01-31T21:09:04Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![dfir](https://avatars.discourse-cdn.com/v4/letter/d/76d3ee/32.png) [@dfir](https://discuss.elastic.co/u/dfir)\ **Post date:** [January 31, 2024, 9:09pm UTC](https://discuss.elastic.co/t/logstash-tab-space-delimiter/352231/1 "2024-01-31T21:09:04Z")
Hi All. I am trying to ingest some IIS logs into Elastic via logtstash. They are CSVs but the separator is NOT a ,. How can I account for a space or a tab as the separator. I have multiple different kinds of files where the delimiter is a space or a tab and not a comma so I need to get this working. Any help would be appreciated. I tried a few different formats: 1. in between the " " in separator is an actual TAB. I tried the tabs also in the columns row as well. The documentation says to not use \t use the actual character. When I run it like this logstash starts up, but never actually ingests anything. If I run this as a straight .log file and not a .csv file the data ingests, but I do not get the column names, it shows up as Column 1, column 2.. etc. ```auto csv { source => "[message]" target => "[csv]" separator => " " columns => ["date","time","s-ip","cs-method","cs-uri-stem","cs-uri-query","s-port","cs-username","c-ip","cs(User-Agent)","cs(Referer)","sc-status","sc-substatus","sc-win32-status","time-taken"] skip_empty_columns => true skip_empty_rows => true } ``` ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [January 31, 2024, 9:16pm UTC](https://discuss.elastic.co/t/logstash-tab-space-delimiter/352231/2 "2024-01-31T21:16:19Z")
The separator is the space " " not the tab for IIS logs. > W3C Extended format is a customizable ASCII format with a variety of different properties. You can log properties important to you, while limiting log size by omitting unwanted property fields. Properties are separated by spaces. Time is recorded as UTC. ---
**Author:** ![dfir](https://avatars.discourse-cdn.com/v4/letter/d/76d3ee/32.png) [@dfir](https://discuss.elastic.co/u/dfir)\ **Post date:** [January 31, 2024, 10:06pm UTC](https://discuss.elastic.co/t/logstash-tab-space-delimiter/352231/3 "2024-01-31T22:06:09Z")
Hi, I had tried the space. Should it be 1 space or 2? I tried both single and double spaces. ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [February 1, 2024, 12:02am UTC](https://discuss.elastic.co/t/logstash-tab-space-delimiter/352231/4 "2024-02-01T00:02:51Z")
Can you copy here a sample from the message as text, not a log line? ---
**Author:** ![dfir](https://avatars.discourse-cdn.com/v4/letter/d/76d3ee/32.png) [@dfir](https://discuss.elastic.co/u/dfir)\ **Post date:** [February 1, 2024, 1:10pm UTC](https://discuss.elastic.co/t/logstash-tab-space-delimiter/352231/5 "2024-02-01T13:10:46Z")
Sure. Here is with the tab: csv { source =\> "[message]" target =\> "[csv]" separator =\> " " columns =\> ["date","time","s-ip","cs-method","cs-uri-stem","cs-uri-query","s-port","cs-username","c-ip","cs(User-Agent)","cs(Referer)","sc-status","sc-substatus","sc-win32-status","time-taken"] skip\_empty\_columns =\> true skip\_empty\_rows =\> true * * * and here with a space. csv { source =\> "[message]" target =\> "[csv]" separator =\> " " columns =\> ["date","time","s-ip","cs-method","cs-uri-stem","cs-uri-query","s-port","cs-username","c-ip","cs(User-Agent)","cs(Referer)","sc-status","sc-substatus","sc-win32-status","time-taken"] skip\_empty\_columns =\> true skip\_empty\_rows =\> true } When I run logstash with this config I get no errors.. logstash starts up initially but never actually runs the ingest. This message repeats in the console: [2024-02-01T13:12:29,268][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=\>"G1 Young Generation"} [2024-02-01T13:12:29,268][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=\>"G1 Old Generation"} [2024-02-01T13:12:32,389][DEBUG][org.logstash.execution.PeriodicFlush][main] Pushing flush onto pipeline. [2024-02-01T13:12:34,070][DEBUG][logstash.instrument.periodicpoller.cgroup] One or more required cgroup files or directories not found: /proc/self/cgroup, /sys/fs/cgroup/cpuacct, /sys/fs/cgroup/cpu ---
**Author:** ![dfir](https://avatars.discourse-cdn.com/v4/letter/d/76d3ee/32.png) [@dfir](https://discuss.elastic.co/u/dfir)\ **Post date:** [February 1, 2024, 2:32pm UTC](https://discuss.elastic.co/t/logstash-tab-space-delimiter/352231/6 "2024-02-01T14:32:57Z")
I was able to get this working. There was a few changes I needed to make. 1. Remove ( ) from the list of Columns in the Conf file The only issue now is the files are getting deleted after processing. I have this line in the conf file. file\_completed\_action =\> "log" any idea why logstash is ignoring it? ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [February 1, 2024, 2:56pm UTC](https://discuss.elastic.co/t/logstash-tab-space-delimiter/352231/7 "2024-02-01T14:56:22Z")
I mean the message sample, the message field not .conf. Anyway you solved. 🙃 > When in `read` mode, what action should be carried out when a file is done with. > The default value for mode is `tail`. Have you set the mode? Default is tail And now copy your the input part. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 29, 2024, 2:57pm UTC](https://discuss.elastic.co/t/logstash-tab-space-delimiter/352231/8 "2024-02-29T14:57:01Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.