Skip to content
Go to file

Sawmill Logo

Build Status Maven Central

Update: June 25, 2020 The 2.0 release of Sawmill introduces a breaking change to the GeoIpProcessor to comply with the updated license of the MaxMind Lite database. See for additional details.

Sawmill is a JSON transformation open source library.

It enables you to enrich, transform, and filter your JSON documents.

Using Sawmill pipelines you can integrate your favorite groks, geoip, user-agent resolving, add or remove fields/tags and more in a descriptive manner, using configuration files or builders, in a simple DSL, allowing you to dynamically change transformations.


Get Sawmill Java via Maven:


or Gradle:

compile 'io.logz.sawmill:sawmill-core:2.0.13'


The full Sawmill documentation can be found here.

Simple configuration example

  "steps": [
      "grok": {
        "config": {
          "field": "message",
          "overwrite": [
          "patterns": [
            "(%{IPORHOST:client_ip}|-) %{USER:ident} %{USER:auth} \\[%{HTTPDATE:timestamp}\\] \\\"(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion:float})?|%{DATA:rawrequest})\\\" %{NUMBER:response:int} (?:%{NUMBER:bytes:float}|-) B %{DATA:thread} %{NUMBER:response_time:float} ms %{DATA:servername} %{DATA:client_id:int}(\\;%{NOTSPACE})? %{DATA:device_id} %{DATA}"
      "removeField": {
        "config": {
          "path": "message"
You can’t perform that action at this time.