Parse CSV

Parses a CSV string read from a field on a log, metric, or trace and writes the resulting fields to a target you choose. You supply the column headers (statically or from another field), and you control the field delimiter, an optional separate header delimiter, and the quote-handling mode.

Supported Telemetry Types

Platform	Metrics	Logs	Traces
Linux	✓	✓	✓
Windows	✓	✓	✓
macOS	✓	✓	✓
AIX	✓	✓	✓
Kubernetes Node	✓	✓	✓
Kubernetes Cluster	✓	✓	✓
Kubernetes Gateway	✓	✓	✓
OpenShift Node	✓	✓	✓
OpenShift Cluster	✓	✓	✓
OpenShift Gateway	✓	✓	✓
Google SecOps Pipelines	✓	✓	✓

Choose Telemetry Type picks one signal per processor instance. Add another instance to handle a second signal.

Configuration

Basic Configuration

When to apply

Parameter	Type	Required	Default	Description
Choose Telemetry Type	Telemetry Selector	Yes	Logs	The signal this instance runs on: Logs, Metrics, or Traces (one at a time).
Condition	OTTL Condition	No	(empty)	Parse only the records that match. Empty runs on every record.

Source and target fields

Parameter	Type	Required	Default	Description
Source Field Type	Enum: Resource, Attribute, Body, Custom	Yes	Attribute	Where the CSV string is read from. Body is logs-only. Custom takes any OTTL path.
Source Field	OTTL Field	Yes *	—	The field holding the CSV string. Use bracket notation for nested fields. For a Body source, leave empty to use the whole body.
Target Field Type	Enum: Resource, Attribute, Body, Custom	Yes	Attribute	Where the parsed fields are written. Body is logs-only. Custom takes any OTTL path.
Target Field	OTTL Field	Yes *	—	Destination for the parsed fields. Leave empty to merge the parsed fields into the chosen target (resource, attributes, or body).

* The Body field type is the exception: it's optional, and leaving the field empty targets the entire body. For Metrics and Traces the field type options are Resource, Attribute, and Custom (no Body).

Headers

Parameter	Type	Required	Default	Description
Header Field Type	Enum: Static String, Resource, Attribute, Body, Custom	Yes	Static String	Where the column headers come from. Static String lets you type the header row directly; the others read it from a field. Body is logs-only.
Headers	String	Yes *	—	The header row as a delimiter-separated string. Applies when Header Field Type is Static String.
Header Field	OTTL Field	Yes *	—	The field holding the header row. Applies when Header Field Type is Resource, Attribute, Body, or Custom. For a Body header, leave empty to use the body string as the headers.

* Headers is required when Header Field Type is Static String; Header Field is required for the field-based header types (Custom requires a value, Resource/Attribute/Body accept bracket-notation paths).

Parsing options

Parameter	Type	Required	Default	Description
Delimiter	String	Yes	,	The separator between fields in the CSV row. Escape sequences such as \t (tab) and \040 (space) are interpreted.
Header Delimiter	String	No	(empty)	The separator for the header row, when it differs from Delimiter. If empty, Delimiter is used for the header too. Escape sequences such as \t (tab) and \040 (space) are interpreted.
Mode	Enum: Strict, Lazy Quotes, Ignore Quotes	Yes	Strict	How quotes are handled. Strict follows normal CSV rules. Lazy Quotes allows bare quotes inside fields. Ignore Quotes ignores all quoting and splits purely on the delimiter.

Examples

Parse a tab-delimited request log from the body

A log's body holds a tab-separated request line, and we want each column as a named attribute.

Sample log entry:

{
  "body": "10.0.0.1\tGET\t200",
  "attributes": {
    "log.file.name": "example.log",
    "log_type": "file"
  }
}

Configure the processor with:

• Source Field Type: Body, Source Field: left empty (parse the whole body)

• Target Field Type: Attribute, Target Field: left empty (merge into attributes)

• Header Field Type: Static String, Headers: ip,method,status

• Delimiter: \t (the fields are tab-separated)

• Header Delimiter: left empty (the header string ip,method,status is comma-separated, so set this to ,)

• Mode: Strict

The resulting log entry:

{
  "body": "10.0.0.1\tGET\t200",
  "attributes": {
    "log.file.name": "example.log",
    "log_type": "file",
    "ip": "10.0.0.1",
    "method": "GET",
    "status": "200"
  }
}

The parsed columns are now addressable fields, so you can filter and route on ip, method, and status.

Configuration Tips

• The field Delimiter and the Header Delimiter can differ. If your data rows are tab-separated but you type the header row with commas, set Delimiter to \t and Header Delimiter to ,.

• Use bracket notation for nested fields in any OTTL field, for example parent["child"].

• For a logs Body target, leaving Target Field empty merges the parsed fields into the body when the body is already a map, and otherwise replaces the body with the parsed map.

Troubleshooting

The parsed fields are missing or empty

Symptoms: the target field is unchanged, or only some columns appear.

Solutions:

1. Confirm the source field actually holds a CSV string and the Condition evaluates true.

2. Check that the number of headers matches the number of columns in each row.

3. Verify the Delimiter matches the data. A row split on the wrong character produces one giant field or mismatched columns.

Fields split in the wrong places when values contain quotes

Symptoms: columns shift, or quoted values are broken apart.

Solutions:

1. If fields contain bare quotes, switch Mode to Lazy Quotes.

2. If your data is not quoted at all and quote characters should be treated as literal text, switch Mode to Ignore Quotes.

Standalone Processor

apiVersion: bindplane.observiq.com/v1
kind: Processor
metadata:
  name: parse-csv
spec:
  type: parse_csv
  parameters:
    - name: telemetry_types
      value: Logs
    - name: log_source_field_type
      value: Body
    - name: log_body_source_field
      value: ""
    - name: log_target_field_type
      value: Attribute
    - name: log_attribute_target_field
      value: ""
    - name: log_header_field_type
      value: Static String
    - name: log_static_header_field
      value: ip,method,status
    - name: logs_delimiter
      value: "\t"
    - name: logs_header_delimiter
      value: ","
    - name: logs_mode
      value: Strict

Related Resources

• ParseCSV — OTTL function reference

Bindplane Resources

These parsers turn embedded strings into structured fields. Chain them with Parse CSV to normalize mixed telemetry:

• Parse JSON

• Parse Key Value

• Parse XML

• Parse Severity

• Parse Timestamp