---
title: Customizing log field behaviors
description: Configure per-field log field behaviors in PingDirectory to preserve, omit, redact, or tokenize values in access log fields for security and usefulness.
component: pingdirectory
version: 11.1
page_id: pingdirectory:pingdirectory_server_administration_guide:pd_ds_customizing_log_field_behaviors
canonical_url: https://docs.pingidentity.com/pingdirectory/11.1/pingdirectory_server_administration_guide/pd_ds_customizing_log_field_behaviors.html
llms_txt: https://docs.pingidentity.com/pingdirectory/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: September 13, 2023
section_ids:
  about-this-task: About this task
  steps: Steps
  example: Example:
  example-2: Example:
  example-3: Example:
---

# Customizing log field behaviors

Use customized log field behaviors on a per-field basis to balance your organization's needs for logs that are both useful and secure.

## About this task

You can use the following properties to configure log field behaviors for either predefined fields in either the `WriterBasedAccessLogFields` or `JSONAccessLogFields` or for custom log fields in third party plugins.

| Behavior                  | Predefined field configuration property | Custom field configuration property    |
| ------------------------- | --------------------------------------- | -------------------------------------- |
| Preserve                  | `preserve-field`                        | `preserve-field-name`                  |
| Omit                      | `omit-field`                            | `omit-field-name`                      |
| Redact entire value       | `redact-entire-value-field`             | `redact-entire-value-field-name`       |
| Redact value components   | `redact-value-components-field`         | `redact-value-components-field-name`   |
| Tokenize entire value     | `tokenize-entire-value-field`           | `tokenize-entire-value-field-name`     |
| Tokenize value components | `tokenize-value-components-field`       | `tokenize-value-components-field-name` |

For more information on log field behaviors, see [Log sanitization options](pd_ds_log_sanitization_types.html).

## Steps

1. To create customized log field behaviors on a per-field basis, run `dsconfig create-log-field-behavior`.

   ### Example:

   The following example defines a log field behavior object so that the logger tokenizes the values of log fields that are expected to contain host names or IP addresses:

   ```
   dsconfig create-log-field-behavior \
       --behavior-name "Tokenize Hostnames" \
       --type text-access \
       --set tokenize-value-components-field:connect-from-address \
       --set tokenize-value-components-field:connect-to-address \
       --set tokenize-value-components-field:entry-rebalancing-source-server \
       --set tokenize-value-components-field:entry-rebalancing-target-server \
       --set tokenize-value-components-field:externally-processed-bind-end-client-ip-address \
       --set tokenize-value-components-field:requester-ip-address \
       --set tokenize-value-components-field:servers-accessed \
       --set tokenize-value-components-field:target-host
   ```

   ### Example:

   The following example defines a log field behavior object so that the logger tokenizes the entire field value of a third party access log field named `myCustomField`:

   ```
   dsconfig create-log-field-behavior \
       --behavior-name "My Log Field Behavior" \
       --type text-access \
       --set tokenize-entire-value-field-name:myCustomField
   ```

   |   |                                                                                                                                                                                                                                              |
   | - | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
   |   | Because the log field behavior does not define a default behavior, it only affects the manner in which specific fields are logged. The default behavior that is configured for the associated log field syntax is used for all other fields. |

2. To associate the log field behavior you created with the loggers in which it should be used, run `dsconfig set-log-publisher-prop`.

   ### Example:

   The following example sets the default log field behavior created in the first example, `"Tokenize Hostnames"` for the file-based access logger:

   ```
   dsconfig set-log-publisher-prop \
       --publisher-name "File-Based Access Logger" \
       --set log-field-behavior:"Tokenize Hostnames"
   ```

3. To finalize your changes, restart the server:

   ```
   bin/stop-server --restart
   ```