logstash-character-hack.conf

input { generator {} }
filter {
  ruby {
    # Add a \t (tab) by using its ASCII code (9)
    code => 'event.set("message", 9.chr + event.get("message"))'
  }

  ruby {
    # Make a new field with the tab removed
    code => 'event.set("tabless", event.get("message").gsub(9.chr, ""))'
  }
}
output { stdout { codec => rubydebug {} } }