Skip to main content

MongoDB - Classic Collector

Thumbnail icon

MongoDB is a source-available cross-platform document-oriented database program. The Sumo Logic app for MongoDB supports logs and metrics from the open source version of MongoDB. The app is tested on the 4.4.4 version of MongoDB.

Log types​

The MongoDB logs are generated in files as configured in the configuration file /var/log/mongodb/mongodb.log. For more details on MongoDB logs, see this link.

The Sumo Logic app for MongoDB supports metrics generated by the MongoDB plugin for Telegraf. The app assumes prometheus format Metrics.

Sample log messages​

{
	"t":{
		"$date":"2021-05-21T10:22:57.373+00:00"
	},
	"s":"I",
	"c":"NETWORK",
	"id":51800,
	"ctx":"conn500659",
	"msg":"client metadata",
	"attr":{
		"remote":"127.0.0.1:49472",
		"client":"conn500659",
		"doc":{
			"application":{
				"name":"MongoDB Shell"
			},
			"driver":{
				"name":"MongoDB Internal Client",
				"version":"4.4.4"
			},
			"os":{
				"type":"Linux",
				"name":"PRETTY_NAME=\"Debian GNU/Linux 10 (buster)\"",
				"architecture":"x86_64",
				"version":"Kernel 4.4.0-62-generic"
			}
		}
	}
}

Sample queries​

Dashboard: MongoDB - Errors and Warnings, Panel: Errors by Component
environment=* db_cluster=* db_system=mongodb  | json "log" as _rawlog nodrop
| if (isEmpty(_rawlog), _raw, _rawlog) as _raw
| json field=_raw "t.$date" as timestamp
| json field=_raw "s" as severity
| json field=_raw "c" as component
| json field=_raw "ctx" as context
| json field=_raw "msg" as msg
| where severity in ("E")
| count by component

Collecting logs and metrics for MongoDB​

This section provides instructions for configuring log and metric collection for the Sumo Logic app for MongoDB.

Configure Collection for MongoDB​

In Kubernetes environments, we use the Telegraf Operator, which is packaged with our Kubernetes collection. You can learn more about it here.The diagram below illustrates how data is collected from MongoDB in a Kubernetes environment. In the architecture shown below, there are four services that make up the metric collection pipeline: Telegraf, Telegraf Operator, Prometheus, and Sumo Logic Distribution for OpenTelemetry Collector.


mongodb_on_k8s

The first service in the metrics pipeline is Telegraf. Telegraf collects metrics from MongoDB. Note that we’re running Telegraf in each pod we want to collect metrics from as a sidecar deployment for example, Telegraf runs in the same pod as the containers it monitors. Telegraf uses the MongoDB input plugin to obtain metrics. (For simplicity, the diagram doesn’t show the input plugins.) The injection of the Telegraf sidecar container is done by the Telegraf Operator. Prometheus pulls metrics from Telegraf and sends them to Sumo Logic Distribution for OpenTelemetry Collector which enriches metadata and sends metrics to Sumo Logic.

In the logs pipeline, Sumo Logic Distribution for OpenTelemetry Collector collects logs written to standard out and forwards them to another instance of Sumo Logic Distribution for OpenTelemetry Collector, which enriches metadata and sends logs to Sumo Logic.

Prerequisites

It’s assumed that you are using the latest helm chart version. If not, upgrade using the instructions here.

Configure Metrics Collection​

This section explains the steps to collect MongoDB metrics from a Kubernetes environment.

  1. Set up Kubernetes Collection with the Telegraf Operator.
  2. On your MongoDB Pods, add the following annotations:
annotations:
  telegraf.influxdata.com/class: sumologic-prometheus
  prometheus.io/scrape: "true"
  prometheus.io/port: "9273"
  telegraf.influxdata.com/inputs: |+
[[inputs.mongodb]]
  servers = ["mongodb://<username-CHANGEME>:<password-CHANGEME>@127.0.0.1:27017"]
  gather_perdb_stats = true
  gather_col_stats = true
  [inputs.mongodb.tags]
    environment ="ENV_TO_BE_CHANGED"
    component ="database"
    db_system ="mongodb"
    db_cluster ="ENV_TO_BE_CHANGED"
    db_cluster_address = "ENV_TO_BE_CHANGED"
    db_cluster_port = "ENV_TO_BE_CHANGED"
  1. Please enter values for the following parameters (marked ENV_TO_BE_CHANGED above):
    • telegraf.influxdata.com/inputs. This contains the required configuration for the Telegraf MongoDB Input plugin. Please refer to this doc for more information on configuring the MongoDB input plugin for Telegraf. Note: As telegraf will be run as a sidecar the host should always be localhost.
      • In the input plugins section ([inputs.MongoDB]):
        • servers - The URL to the MongoDB server. This can be a comma-separated list to connect to multiple MongoDB servers. Please see this doc for more information on additional parameters for configuring the MongoDB input plugin for Telegraf.
      • In the tags section ([inputs.MongoDB.tags]):
        • environment. This is the deployment environment where the MongoDB cluster identified by the value of servers resides. For example: dev, prod or qa. While this value is optional we highly recommend setting it.
        • db_cluster. Enter a name to identify this MongoDB cluster. This cluster name will be shown in the Sumo Logic dashboards.
          • db_cluster_address - Enter the cluster hostname or ip address that is used by the application to connect to the database. It could also be the load balancer or proxy endpoint.
          • db_cluster_port - Enter the database port. If not provided, a default port will be used.
note

db_cluster_address and db_cluster_port should reflect the exact configuration of DB client configuration in your application, especially if you instrument it with OT tracing. The values of these fields should match exactly the connection string used by the database client (reported as values for net.peer.name and net.peer.port metadata fields).

For example, if your application uses “mongodb-prod.sumologic.com:3306” as the connection string, the field values should be set as follows: db_cluster_address=mongodb-prod.sumologic.com db_cluster_port=3306

If your application connects directly to a given mongodb node, rather than the whole cluster, use the application connection string to override the value of the “host” field in the Telegraf configuration: host=mongodb-prod.sumologic.com

Pivoting to Tracing data from Entity Inspector is possible only for “MongoDB address” Entities.

  • Do not modify the following values as it will cause the Sumo Logic app to not function correctly.
    • telegraf.influxdata.com/class: sumologic-prometheus. This instructs the Telegraf operator what output to use. This should not be changed.
    • prometheus.io/scrape: "true". This ensures our Prometheus will scrape the metrics.
    • prometheus.io/port: "9273". This tells prometheus what ports to scrape on. This should not be changed.
    • telegraf.influxdata.com/inputs
      • In the tags section ([inputs.mongodb.tags]):
        • component: “database” - This value is used by Sumo Logic apps to identify application components.
        • db_system: “mongodb” - This value identifies the database system.
  • See this doc for more parameters that can be configured in the Telegraf agent globally.
  1. Sumo Logic Kubernetes collection will automatically start collecting metrics from the pods having the labels and annotations defined in the previous step.
  2. Verify metrics in Sumo Logic.

Configure Logs Collection​

This section explains the steps to collect MongoDB logs from a Kubernetes environment.

  1. Add labels on your MongoDB pods to capture logs from standard output on Kubernetes. Make sure that the logs from MongoDB are sent to stdout. For more details, see this doc.
    1. Apply following labels to the MongoDB pods:
    labels:
        environment: "prod"
        component: "database"
        db_system: "mongodb"
        db_cluster: "mongodb_prod_cluster01"
    1. Enter in values for the following parameters:
    • environment. This is the deployment environment where the MongoDB cluster identified by the value of servers resides. For example: dev, prod or qa. While this value is optional we highly recommend setting it.
    • db_cluster. Enter a name to identify this MongoDB cluster. This cluster name will be shown in the Sumo Logic dashboards.
      • db_cluster_address - Enter the cluster hostname or ip address that is used by the application to connect to the database. It could also be the load balancer or proxy endpoint.
      • db_cluster_port - Enter the database port. If not provided, a default port will be used.
note

db_cluster_address and db_cluster_port should reflect exact configuration of DB client configuration in your application, especially if you instrument it with OT tracing. The values of these fields should match exactly the connection string used by the database client (reported as values for net.peer.name and net.peer.port metadata fields).

For example, if your application uses “mongodb-prod.sumologic.com:3306” as the connection string, the field values should be set as follows: db_cluster_address=mongodb-prod.sumologic.com db_cluster_port=3306

If your application connects directly to a given mongodb node, rather than the whole cluster, use the application connection string to override the value of the “host” field in the Telegraf configuration: host=mongodb-prod.sumologic.com.

Pivoting to Tracing data from Entity Inspector is possible only for “MongoDB address” Entities.

  • Do not modify the following values as they will cause the Sumo Logic apps to not function correctly.
    • component: “database”. This value is used by Sumo Logic apps to identify application components.
    • db_system: “mongodb”. This value identifies the database system.
  • See this doc for more parameters that can be configured in the Telegraf agent globally.
  1. Collecting MongoDB Logs from a Log File (Optional). Follow the steps below to capture MongoDB logs from a log file on Kubernetes.
    1. Determine the location of the MongoDB log file on Kubernetes. This can be determined from the MongoDB.conf for your MongoDB cluster along with the mounts on the MongoDB pods.
    2. Install the Sumo Logic tailing sidecar operator.
    3. Add the following annotation in addition to the existing annotations.
    annotations:
      tailing-sidecar: sidecarconfig;<mount>:<path_of_MongoDB_log_file>/<MongoDB_log_file_name>
    Example: 
     annotations:
      tailing-sidecar: sidecarconfig;data:/mongo-prim-data/MongoDB.log
    1. Make sure that the MongoDB pods are running and annotations are applied by using the command:
    kubectl describe pod <MongoDB_pod_name>
    1. Sumo Logic Kubernetes collection will automatically start collecting logs from the pods having the annotations defined above.


FER to normalize the fields in Kubernetes environments. Labels created in Kubernetes environments automatically are prefixed with pod_labels. To normalize these for our app to work, a Field Extraction Rule named AppObservabilityMongoDBDatabaseFER is automatically created for Database Application Components.


Installing the MongoDB app​

To install the app:

  1. Select App Catalog.
  2. In the 🔎 Search Apps field, run a search for your desired app, then select it.
  3. Click Install App.
    note

    Sometimes this button says Add Integration.

  4. On the next configuration page, under Select Data Source for your App, complete the following fields:
    • Data Source. Select one of the following options:
      • Choose Source Category and select a source category from the list; or
      • Choose Enter a Custom Data Filter, and enter a custom source category beginning with an underscore. For example, _sourceCategory=MyCategory.
    • Folder Name. You can retain the existing name or enter a custom name of your choice for the app.
    • All Folders (optional). The default location is the Personal folder in your Library. If desired, you can choose a different location and/or click New Folder to add it to a new folder.
  5. Click Next.
  6. Look for the dialog confirming that your app was installed successfully.
    app-success.png

Post-installation

Once your app is installed, it will appear in your Personal folder or the folder that you specified. From here, you can share it with other users in your organization. Dashboard panels will automatically start to fill with data matching the time range query received since you created the panel. Results won't be available immediately, but within about 20 minutes, you'll see completed graphs and maps.

As part of the app installation process, the following fields will be created by default:

  • component
  • environment
  • db_system
  • db_cluster
  • db_cluster_address
  • db_cluster_port

Additionally, if you're using MongoDB in the Kubernetes environment, the following additional fields will be created by default during the app installation process:

  • pod_labels_component
  • pod_labels_environment
  • pod_labels_db_system
  • pod_labels_db_cluster
  • pod_labels_db_cluster_address
  • pod_labels_db_cluster_port

For information on setting up fields, see Fields.

Viewing MongoDB Dashboards​

All dashboards have a set of filters that you can apply to the entire dashboard. Use these filters to drill down and examine the data to a granular level.

  • You can change the time range for a dashboard or panel by selecting a predefined interval from a drop-down list, choosing a recently used time range, or specifying custom dates and times. Learn more.
  • You can use template variables to drill down and examine the data on a granular level. For more information, see Filtering Dashboards with Template Variables.
  • Most Next-Gen apps allow you to provide the scope at the installation time and are comprised of a key (_sourceCategory by default) and a default value for this key. Based on your input, the app dashboards will be parameterized with a dashboard variable, allowing you to change the dataset queried by all panels. This eliminates the need to create multiple copies of the same dashboard with different queries.

Overview​

The MongoDB - Overview dashboard provides an at-a-glance view of MongoDB health, performance and problems causing errors.

Use this dashboard to:

  • Identify Slow Queries impacting the performance.
  • Gain insights into Replication and Sharding operations.
  • Verify Page Faults generated to determine the root cause of the problems.
MongoDB dashboards

Resource​

The MongoDB - Resource dashboard shows resource utilization by the MongoDB component.

Use this dashboard to:

  • Determine Memory and Disk Usage.
  • Identify potential resource constraints and issues.
MongoDB dashboards

Errors and Warnings​

The MongoDB - Errors and Warnings dashboard shows errors and warnings by the MongoDB component.

Use this dashboard to:

  • Determine components producing multiple errors or warnings.
MongoDB dashboards

Logins and Connections​

The MongoDB - Logins and Connections dashboard shows geo location of client connection requests, failed connection logins by geo location, and count of failed login attempts.

Use this dashboard to:

  • Determine potential hacking attempts.
  • Determine location of attacks.
MongoDB dashboards

Query Logs​

The MongoDB - Query Logs dashboard shows read and write query trends.

Use this dashboard to:

  • Monitor abnormal spikes in Query volume.
  • Identify the read versus write ratio of your application queries. ing or adjusting indexes to improve query performance.
MongoDB dashboards

Replication Logs​

The MongoDB - Replication Logs dashboard shows replica deletes/updates/inserts trend and replica state.

Use this dashboard to:

  • Monitor replication state and replication events like inserts/updates/commands per second.
  • Track Replication Oplog window to identify replication delay.
MongoDB dashboards

Sharding​

The MongoDB - Sharding dashboard dashboard shows sharding related errors, events, failures and number of chunks moving between shards.

Use this dashboard to:

  • Identify Sharding errors and warnings.
  • Gain insights into Chunk operations.
MongoDB dashboards

Create monitors for MongoDB app​

From your App Catalog:

  1. From the Sumo Logic navigation, select App Catalog.
  2. In the Search Apps field, search for and then select your app.
  3. Make sure the app is installed.
  4. Navigate to What's Included tab and scroll down to the Monitors section.
  5. Click Create next to the pre-configured monitors. In the create monitors window, adjust the trigger conditions and notifications settings based on your requirements.
  6. Scroll down to Monitor Details.
  7. Under Location click on New Folder.
    note

    By default, monitor will be saved in the root folder. So to make the maintenance easier, create a new folder in the location of your choice.

  8. Enter Folder Name. Folder Description is optional.
    tip

    Using app version in the folder name will be helpful to determine the versioning for future updates.

  9. Click Create. Once the folder is created, click on Save.

MongoDB alerts​

NameDescriptionTrigger TypeAlert ConditionsRecover Conditions
MongoDB - Too Many Cursors TimeoutsThis alert fires when we detect that there are too many cursors (100) timing out on a MongoDB server within a 5 minute time interval.Warning>= 100< 100
MongoDB - Too Many Cursors OpenThis alert fires when we detect that there are too many cursors (>10K) opened by MongoDB.Warning>= 10000< 10000
MongoDB - Missing PrimaryThis alert fires when we detect that a MongoDB cluster has no node marked as primary.Critical<= 0> 0
MongoDB - Instance DownThis alert fires when we detect that the MongoDB instance is down.Missing Data:--:--
MongoDB - Replication LagThis alert fires when we detect that the replica lag for a given MongoDB cluster is greater than 60 seconds. Please review the replication configuration.Warning> 60<= 60
MongoDB - Replication Heartbeat ErrorThis alert fires when we detect that the MongoDB Replication Heartbeat request has errors, which indicates replication is not working as expected.Warning> 0<= 0
MongoDB - Too Many ConnectionsThis alert fires when we detect a given MongoDB server has too many connections (over 80% of capacity).Warning>= 80< 80
MongoDB - Secondary Node Replication FailureThis alert fires when we detect that a MongoDB secondary node is out of sync for replication.Warning> 0<= 0
MongoDB - Slow QueriesThis alert fires when we detect that a MongoDB cluster is executing slow queries.Warning> 0<= 0
MongoDB - Sharding WarningThis alert fires when we detect warnings in MongoDB sharding operations.Warning> 0<= 0
MongoDB - Sharding Chunk Split FailureThis alert fires when we detect that a MongoDB chunk not been split during sharding.Warning> 0<= 0
MongoDB - Sharding ErrorThis alert fires when we detect errors in MongoDB sharding operations.Critical> 0<= 0
MongoDB - Replication ErrorThis alert fires when we detect errors in MongoDB replication operations.Warning> 0<= 0
MongoDB - Sharding Balancer FailureThis alert fires when we detect that data balancing failed on a MongoDB Cluster with 1 mongos instance and 3 mongod instances.Warning> 0<= 0
Status
Legal
Privacy Statement
Terms of Use

Copyright © 2025 by Sumo Logic, Inc.