Phileas in Graylog – Removing PII from Logs
We are very excited to share with you that Graylog has integrated Phileas, the open source PII/PHI redaction engine, into their centralized log management solution. With this new integration, Graylog now has the ability to identify and redact different types of PII (personally identifiable information) present in logs.
The presence of PII in logs is a serious concern. Even careful application developers can find it difficult to prevent all PII from being included in logs. Error messages and stack traces can inadvertently include PII exposing the business to risk and liability.
Phileas is the heart of Philter, an API-based redaction engine. Philter, also open source, provides users with a centralized tool for finding and manipulating PII and PHI in text. With Philter, sensitive information can be redacted, masked, or pseudonymized. Philter is available on the AWS, Google Cloud, and Microsoft Azure marketplaces for deployment into your private cloud. Philter requires no outside internet access so your sensitive data never needs to leave your network to be redacted.
Because Phileas is licensed under the business-friendly open source Apache license, organizations are able to bring Phileas’ ability to find and redact PII into their own applications. To learn more about Phileas or to get started integrating Phileas into your applications, visit the Phileas repository on GitHub.
Presenting together at API Days NYC 2025
In May 2025, Jeff Zemerick of Philterd and Rob Dickinson of Graylog API Security gave a joint presentation at API Days NYC called “Catching the Quiet Thief: Detecting Data Exfiltration with Graylog and Phileas.” The talk started from an uncomfortable premise. APIs are a very good way to steal data, and no combination of WAFs, gateways, and authentication makes them perfect. If you can’t prevent every exfiltration, you need to be able to see it, and that means spotting PII moving through API traffic in real time.
Rob covered why that is hard in practice: production APIs are big and noisy, a lot of exfiltration is low and slow, and most of the community tooling for PII detection is written in Python and leans on LLMs. Graylog needed something that fit into existing Java services and containers, could be configured for specific PII types, and could keep up with at least 10,000 detections per second per core. Jeff then walked through Phileas, why it exists, and what a few lines of Java look like to redact text and inspect each detected span.
That slide is the whole point of how Phileas is built. It is a library, not a service. It runs inside the Java service that is already handling the API traffic, so there is no extra network hop, no separate server to scale, and no copy of the data going somewhere else to be inspected. For a log or API monitoring pipeline, that matters more than any single detection feature. If detection adds latency or a new place for sensitive data to sit, nobody will turn it on.
The loop over spans is the part people tend to skip past, and for this use case it is the important part. Redacting text is useful, but for detecting exfiltration you want to know what was found: which type of PII, where in the message it appeared, and how confident Phileas was about it. That is what lets a security team write an alert like “this endpoint started returning Social Security numbers” instead of just scrubbing them quietly.
What decides what Phileas looks for is a policy, a JSON file that lists the entity types to detect and what to do with each one. A policy can mask a value, redact it, encrypt it, replace it with a synthetic value, or pass it through untouched. Detection comes from regular expressions, dictionaries, and validators that check things like Luhn checksums and SSN structure, so a format-valid look-alike is less likely to be flagged. When patterns aren’t enough, Phileas can call PhEye to run an NLP model for things like person names.
The slides are available as a PDF: Catching the Quiet Thief (API Days NYC 2025).
Related posts: