Collect MongoDB logs with OpenTelemetry

Overview

MongoDB writes a single server log (mongod.log) for connections, commands, storage, and replication. Since version 4.4 each line is a structured JSON document. The OpenTelemetry Collector’s filelog receiver tails the log, parses the JSON, and ships the records to Osuite over OTLP. This page collects logs; for operation, connection, and replication metrics see Monitor MongoDB with OpenTelemetry.

Prerequisites

• MongoDB 4.4 or later, logging to a file. On most distributions the default is /var/log/mongodb/mongod.log (set by systemLog.path).
• The OpenTelemetry Collector installed on the host, with read access to the log directory.
• An Osuite ingest token and endpoint — see Getting Started.

Note

The official MongoDB container image logs to stdout. In containers, collect that stream with Docker container logs or Kubernetes pod logs — the parsing operators below still apply, since the JSON format is the same.

Collector config

This otel-collector.yaml tails mongod.log and parses each line as JSON, reading the nested timestamp and the single-letter severity. Adjust the include path if your systemLog.path differs.

receivers:
  filelog/mongodb:
    include:
      - /var/log/mongodb/mongod.log
    start_at: end
    operators:
      - type: json_parser
        timestamp:
          parse_from: attributes.t["$date"]
          layout_type: strptime
          layout: '%Y-%m-%dT%H:%M:%S.%f%z'
        severity:
          parse_from: attributes.s
          mapping:
            debug: D
            info: I
            warn: W
            error: E
            fatal: F
      - type: move
        from: attributes.msg
        to: body

processors:
  batch: {}
  resourcedetection:
    detectors: [system]
  resource:
    attributes:
      - key: service.name
        value: mongodb
        action: upsert

exporters:
  otlp/osuite:
    endpoint: ingest.<region>.osuite.io:443
    tls:
      insecure: false
    headers:
      x-osuite-ingest-token: <your-ingest-token>

service:
  pipelines:
    logs:
      receivers: [filelog/mongodb]
      processors: [batch, resourcedetection, resource]
      exporters: [otlp/osuite]

Parsing and enrichment

• Format assumption — the config parses MongoDB 4.4+ structured logging, where each line looks like {"t":{"$date":"2025-10-15T12:34:56.789+00:00"},"s":"I","c":"NETWORK","id":22943,"ctx":"listener","msg":"..."}. MongoDB versions before 4.4 wrote a plain-text log; for those, replace json_parser with a regex_parser.
• Nested timestamp — the event time lives under t.$date. The attributes.t["$date"] selector reaches the nested key, and the %z offset in the layout handles the trailing zone.
• Severity — the s field holds a single letter: D debug, I info, W warning, E error, F fatal. The mapping translates it to the record’s SeverityNumber. See severity.
• Body and component — the move operator promotes the msg field to the record body; the component (c) and context (ctx) stay as attributes for filtering.
• Host and service attributes — the resourcedetection and resource processors tag each record with the host name and a stable service.name.

Verify in Osuite

What you should see

Within a minute, MongoDB records appear in the Logs Explorer tagged with service.name=mongodb and the host name. Each record shows its message in the body, with the component and context available as attributes, and filtering by severity isolates E and F entries.

Troubleshooting

If lines arrive unparsed in the body, your MongoDB predates 4.4 and writes plain text rather than JSON — switch the receiver to a regex_parser. If the timestamp is wrong, confirm the t.$date value carries a zone offset; a +00:00 style offset is expected and parsed by the %z layout.

No data in Osuite after a few minutes? Work through these checks.

• Endpoint — confirm the exporter targets exactly ingest.<region>.osuite.io:443 for your region, over TLS.
• Token — confirm the ingest header carries a valid <your-ingest-token> and has not been rotated.
• Pipeline — confirm the signal you expect (traces, logs, or metrics) is wired into an active pipeline with the otlp/osuite exporter attached.
• Export errors — check the application or Collector logs for OTLP export failures (auth, DNS, TLS, connection refused).
• Network — confirm the host has outbound access to the ingest endpoint on port 443.
• Timing — allow up to a minute for the first data to appear before assuming a failure.

Still stuck? Ask the Investigation Agent or contact support.