diff --git a/cfg.lex b/cfg.lex
index f305ea2b896..d0b5e8d2075 100644
--- a/cfg.lex
+++ b/cfg.lex
@@ -280,6 +280,8 @@ MCAST_TTL			"mcast_ttl"
 TOS					"tos"
 DISABLE_DNS_FAILOVER  "disable_dns_failover"
 REDACT_PII_ "redact_pii_"
+REDACT_TEMPLATE "redact_template"
+REDACT_MODE "redact_mode"
 DISABLE_DNS_BLACKLIST "disable_dns_blacklist"
 DST_BLACKLIST		"dst_blacklist"
 MAX_WHILE_LOOPS "max_while_loops"
@@ -527,6 +529,10 @@ SPACE		[ ]
 									return DISABLE_DNS_FAILOVER; }
 <INITIAL>{REDACT_PII_}	{	count(); yylval.strval=yytext; 
 									return REDACT_PII_;}
+<INITIAL>{REDACT_TEMPLATE}	{	count(); yylval.strval=yytext;
+									return REDACT_TEMPLATE;}
+<INITIAL>{REDACT_MODE}	{	count(); yylval.strval=yytext;
+									return REDACT_MODE;}
 <INITIAL>{DISABLE_DNS_BLACKLIST}	{	count(); yylval.strval=yytext;
 									return DISABLE_DNS_BLACKLIST; }
 <INITIAL>{DST_BLACKLIST}	{	count(); yylval.strval=yytext;
diff --git a/cfg.y b/cfg.y
index e4097cd6997..88c30e68df9 100644
--- a/cfg.y
+++ b/cfg.y
@@ -111,6 +111,7 @@
 #include "config.h"
 #include "mem/rpm_mem.h"
 #include "poll_types.h"
+#include "redact_pii.h"
 
 #ifdef SHM_EXTRA_STATS
 #include "mem/module_info.h"
@@ -394,6 +395,8 @@ extern int cfg_parse_only_routes;
 %token TOS
 %token DISABLE_DNS_FAILOVER
 %token REDACT_PII_
+%token REDACT_TEMPLATE
+%token REDACT_MODE
 %token DISABLE_DNS_BLACKLIST
 %token DST_BLACKLIST
 %token DISABLE_STATELESS_FWD
@@ -1592,7 +1595,53 @@ assign_stm: LOGLEVEL EQUAL snumber { IFOR();
 		| REDACT_PII_ EQUAL NUMBER { IFOR();
 										redact_pii_=$3;
 									}
-		| REDACT_PII_ error { yyerror("boolean value expected"); }				
+		| REDACT_PII_ error { yyerror("boolean value expected"); }
+		| REDACT_TEMPLATE EQUAL STRING { IFOR();
+										redact_template=$3;
+										if (redact_mode == REDACT_FORMAT) {
+											char *pct = strstr(redact_template, "%s");
+											if (pct) {
+												redact_fmt.left.s = redact_template;
+												redact_fmt.left.len = pct - redact_template;
+												redact_fmt.right.s = pct + 2;
+												redact_fmt.right.len = strlen(pct + 2);
+											} else {
+												redact_fmt.left.s = redact_template;
+												redact_fmt.left.len = strlen(redact_template);
+												redact_fmt.right.s = "";
+												redact_fmt.right.len = 0;
+											}
+										}
+									}
+		| REDACT_TEMPLATE error { yyerror("string value expected"); }
+		| REDACT_MODE EQUAL STRING { IFOR();
+										if (strcasecmp($3, "replace")==0)
+											redact_mode=REDACT_REPLACE;
+										else if (strcasecmp($3, "append")==0)
+											redact_mode=REDACT_APPEND;
+										else if (strcasecmp($3, "prepend")==0)
+											redact_mode=REDACT_PREPEND;
+										else if (strcasecmp($3, "format")==0) {
+											redact_mode=REDACT_FORMAT;
+											if (redact_template) {
+												char *pct = strstr(redact_template, "%s");
+												if (pct) {
+													redact_fmt.left.s = redact_template;
+													redact_fmt.left.len = pct - redact_template;
+													redact_fmt.right.s = pct + 2;
+													redact_fmt.right.len = strlen(pct + 2);
+												} else {
+													redact_fmt.left.s = redact_template;
+													redact_fmt.left.len = strlen(redact_template);
+													redact_fmt.right.s = "";
+													redact_fmt.right.len = 0;
+												}
+											}
+										}
+										else
+											yyerror("redact_mode must be: replace|append|prepend|format");
+									}
+		| REDACT_MODE error { yyerror("string value expected (replace|append|prepend|format)"); }
 		| DISABLE_DNS_BLACKLIST EQUAL NUMBER { IFOR();
 										disable_dns_blacklist=$3;
 									}
diff --git a/redact_pii.c b/redact_pii.c
index 1ad0a85b6c1..ac312d7141e 100644
--- a/redact_pii.c
+++ b/redact_pii.c
@@ -3,7 +3,57 @@
 #include "redact_pii.h"
 
 int redact_pii_ = 0;
+char *redact_template = "****";
+int redact_mode = REDACT_REPLACE;
+redact_log_format_t redact_fmt = {{NULL, 0}, {NULL, 0}};
 
-inline const char* redact_pii(const char* input) { 
-    return redact_pii_ ? "****" : ZSW(input); 
+#define REDACT_BUF_SIZE 512
+
+inline const char* redact_pii(const char* input) {
+	static char buf[REDACT_BUF_SIZE];
+	const char *safe = ZSW(input);
+	size_t input_len, idx;
+
+	if (!redact_pii_)
+		return safe;
+
+	switch (redact_mode) {
+	case REDACT_REPLACE:
+		return redact_template;
+	case REDACT_APPEND:
+		input_len = strlen(safe);
+		idx = 0;
+		memcpy(buf + idx, safe, input_len);
+		idx += input_len;
+		memcpy(buf + idx, redact_template, strlen(redact_template));
+		idx += strlen(redact_template);
+		buf[idx] = '\0';
+		return buf;
+	case REDACT_PREPEND:
+		input_len = strlen(safe);
+		idx = 0;
+		memcpy(buf + idx, redact_template, strlen(redact_template));
+		idx += strlen(redact_template);
+		memcpy(buf + idx, safe, input_len);
+		idx += input_len;
+		buf[idx] = '\0';
+		return buf;
+	case REDACT_FORMAT:
+		input_len = strlen(safe);
+		idx = 0;
+		if (redact_fmt.left.len > 0) {
+			memcpy(buf + idx, redact_fmt.left.s, redact_fmt.left.len);
+			idx += redact_fmt.left.len;
+		}
+		memcpy(buf + idx, safe, input_len);
+		idx += input_len;
+		if (redact_fmt.right.len > 0) {
+			memcpy(buf + idx, redact_fmt.right.s, redact_fmt.right.len);
+			idx += redact_fmt.right.len;
+		}
+		buf[idx] = '\0';
+		return buf;
+	default:
+		return redact_template;
+	}
 }
diff --git a/redact_pii.h b/redact_pii.h
index 5a6f2d589a6..1a2faa254ff 100644
--- a/redact_pii.h
+++ b/redact_pii.h
@@ -20,6 +20,25 @@
 #ifndef redact_pii_h
 #define redact_pii_h
 
+#include "str.h"
+
+enum {
+    REDACT_REPLACE = 0,
+    REDACT_APPEND,
+    REDACT_PREPEND,
+    REDACT_FORMAT
+};
+
+typedef struct {
+    str left;
+    str right;
+} redact_log_format_t;
+
+extern int redact_pii_;
+extern char *redact_template;
+extern int redact_mode;
+extern redact_log_format_t redact_fmt;
 
 const char* redact_pii(const char* input);
+
 #endif