diff --git a/config.yaml-sample b/config.yaml-sample
index 922e123..e97295a 100644
--- a/config.yaml-sample
+++ b/config.yaml-sample
@@ -13,3 +13,25 @@ MATRIX_PNUT_TOKEN: '<AUTH_TOKEN>'  # pnut.io auth token for the matrix bot
 PNUTCLIENT_ID: '<CLIENT_ID>'  # pnut.io app client ID
 PNUT_APPTOKEN: '<APP TOKEN>'  # pnut.io app token
 PNUT_APPKEY: '<APPSTREAM KEY>'  # pnut.io app stream key
+
+logging:
+  version: 1
+  formatters:
+    precise:
+      format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(message)s'
+    normal:
+      format: '%(name)s - %(levelname)s - %(message)s'
+  handlers:
+    console:
+      class: logging.StreamHandler
+      formatter: normal
+  loggers:
+    werkzeug:
+      level: DEBUG
+    appservice:
+      level: DEBUG
+    urllib3.connectionpool:
+      level: DEBUG
+  root:
+    level: DEBUG
+    handlers: [console]
diff --git a/pnut-matrix.py b/pnut-matrix.py
index 0792431..3212f82 100644
--- a/pnut-matrix.py
+++ b/pnut-matrix.py
@@ -2,6 +2,7 @@ import websocket
 import threading
 import time
 import logging
+import logging.config
 import yaml
 import json
 import pnutpy
@@ -9,6 +10,7 @@ import requests
 import magic
 import argparse
 import os
+import re
 
 from matrix_client.api import MatrixHttpApi
 from matrix_client.api import MatrixError, MatrixRequestError
@@ -22,6 +24,21 @@ logger = logging.getLogger()
 _shutdown = threading.Event()
 _reconnect = threading.Event()
 
+class MLogFilter(logging.Filter):
+
+    ACCESS_TOKEN_RE = re.compile(r"(\?.*access(_|%5[Ff])token=)[^&]*(\s.*)$")
+    ACCESS_TOKEN_RE2 = re.compile(r"(\?.*access(_|%5[Ff])token=)[^&]*(.*)$")
+
+    def filter(self, record):
+        if record.name == "werkzeug" and len(record.args) > 0:
+            redacted_uri = MLogFilter.ACCESS_TOKEN_RE.sub(r"\1<redacted>\3", record.args[0])
+            record.args = (redacted_uri, ) + record.args[1:]
+        elif record.name == "urllib3.connectionpool" and len(record.args) > 3:
+            redacted_uri = MLogFilter.ACCESS_TOKEN_RE2.sub(r"\1<redacted>\3", record.args[4])
+            record.args = record.args[:4] + (redacted_uri,) + record.args[5:]
+
+        return True
+
 def new_message(msg, meta):
     logger.debug("channel: " + msg.channel_id)
     logger.debug("username: " + msg.user.username)
@@ -368,17 +385,17 @@ if __name__ == '__main__':
     # )
     args = a_parser.parse_args()
 
-    if args.debug:
-        # websocket.enableTrace(True)
-        logging.basicConfig(level=logging.DEBUG)
-    else:
-        logging.basicConfig(level=logging.INFO)
-
     configyaml = os.environ.get("CONFIG_FILE")
 
     with open(configyaml, "rb") as config_file:
         config = yaml.load(config_file, Loader=yaml.SafeLoader)
 
+    # websocket.enableTrace(True)
+    logging.config.dictConfig(config['logging'])
+    redact_filter = MLogFilter()
+    logging.getLogger("werkzeug").addFilter(redact_filter)
+    logging.getLogger("urllib3.connectionpool").addFilter(redact_filter)
+
     ws_url = 'wss://stream.pnut.io/v1/app?access_token='
     ws_url += config['PNUT_APPTOKEN'] + '&key=' + config['PNUT_APPKEY']
     ws_url += '&include_raw=1'