Mongodb Receiver
contrib
Maintainers: @justinianvoss22, @dyl10s, @ishleenk17, @shrenikjain38, @ebrdarSplunk, @XSAM, @akshays-19, @sv-splunk, @splunk-shanu
Source: opentelemetry-collector-contrib
Supported Telemetry
Overview
Purpose
The purpose of this receiver is to allow users to monitor metrics from standalone MongoDB clusters. This includes non-Atlas managed MongoDB Servers.Prerequisites
This receiver supports MongoDB versions:- 4.4+
- 5.0
- 6.0
- 7.0
clusterMonitor role in order to collect metrics. Please refer to lpu.sh for an example of how to configure these permissions.
Permissions for explain plans (db.server.top_query)
The clusterMonitor role is sufficient for metrics and basic slow query collection (profiler data and getLog). However, populating mongodb.explain_plan.text and mongodb.explain_plan.hash on db.server.top_query events requires the receiver to run explain against user collections, which needs the find privilege on each monitored database.
Without this permission, slow query collection still works but explain fields are empty and an Unauthorized warning is logged for each query.
To enable explain plans, grant read on each database you want to monitor (recommended — least privilege):
readAnyDatabase to cover all databases on the server:
max_explain_each_interval: 0 in top_query_collection.
Configuration
The following settings are optional:hosts(default:[{endpoint: "localhost:27017"}]): list of objects with anendpointfield set tohost:portor a unix domain socket path. Thetransportoption is no longer available.- For standalone MongoDB deployments this is the hostname and port of the mongod instance
- For replica sets specify the hostnames and ports of the mongod instances that are in the replica set configuration. If the
replica_setfield is specified, nodes will be autodiscovered. - For a sharded MongoDB deployment, please specify a list of the
mongoshosts.
scheme(default:mongodb): connection scheme. Usemongodb+srvfor clusters that use SRV DNS records (e.g. MongoDB Atlas). When usingmongodb+srv, exactly one host must be specified.username: If authentication is required, the user can withclusterMonitorpermissions can be provided here.password: If authentication is required, the password can be provided here.auth_mechanism: (optional) The authentication mechanism to use. Common values includeSCRAM-SHA-1,SCRAM-SHA-256,MONGODB-X509,GSSAPI,MONGODB-AWS, etc. If not specified, MongoDB will use the default mechanism.auth_source: (optional) The database name to use for authentication. If not specified, MongoDB will use the default authentication database (usuallyadmin).auth_mechanism_properties: (optional) A map of key-value pairs specifying additional properties for the authentication mechanism. For example, when usingGSSAPI(Kerberos), you may need to setSERVICE_NAME. ForMONGODB-AWS, you may need to setAWS_SESSION_TOKENwhen using temporary AWS credentials.collection_interval: (default =1m): This receiver collects metrics on an interval. This value must be a string readable by Golang’s time.ParseDuration. Valid time units arens,us(orµs),ms,s,m,h.initial_delay(default =1s): defines how long this receiver waits before starting.replica_set: If the deployment of MongoDB is a replica set then this allows users to specify the replica set name which allows for autodiscovery of other nodes in the replica set.timeout: (default =1m) The timeout of running commands against mongo.tls: TLS control. By default, insecure settings are rejected and certificate verification is on.direct_connection: If true, then the driver will not try to autodiscover other nodes, and perform instead a direct connection o the host.query_sample_collection: Additional configuration for query sample collection (db.server.query_sampleevent):max_rows_per_query: (default =100) The maximum number of eligible query samples to emit per$currentOpquery. Must be greater than0.
Top Query Collection
The receiver can collect the top slow queries from MongoDB usingsystem.profile (when profiling is enabled) or the diagnostic log ring buffer (getLog) as a fallback. To enable it:
top_query_collection:
collection_interval: (default =60s) How often to scrape slow query data. Independent of the receiver’scollection_interval.top_query_count: (default =500) The maximum number of slow query events to emit per scrape. The slowest N executions are selected.max_query_sample_count: (default =1000) The maximum number of slow query entries to read fromsystem.profileorgetLogper scrape before ranking.max_explain_each_interval: (default =250) The maximum number of server-sideexplaincalls to issue per scrape interval. Set to0to disable explain plan collection entirely.query_plan_cache_size: (default =500) The number of query shapes whose explain plans are cached. Set to0to disable caching.query_plan_cache_ttl: (default =10m) How long a cached explain plan is considered valid.
Example Configuration
Example Configuration (MongoDB Atlas / SRV)
Authentication
The receiver supports several MongoDB authentication mechanisms. Theauth_mechanism, auth_source, and auth_mechanism_properties fields are passed directly to the MongoDB Go driver’s options.Credential struct.
SCRAM (Default)
SCRAM-SHA-256 is the default authentication mechanism for MongoDB 4.0+. Ifauth_mechanism is not specified and username/password are provided, the driver will negotiate the strongest SCRAM mechanism supported by the server (SCRAM-SHA-256, falling back to SCRAM-SHA-1).
X.509 Certificate Authentication
X.509 authentication uses TLS client certificates instead of username and password. The certificate’s subject DN is used as the identity.tlsCertificateKeyFile) containing both the certificate and private key. However, the receiver uses the OpenTelemetry Collector’s standard TLS configuration, which requires separate cert_file and key_file entries.
If you have a combined PEM file, split it into separate files:
MONGODB-AWS (IAM Authentication)
MONGODB-AWS authenticates using AWS IAM credentials. This mechanism is available in MongoDB 4.4+ and requires server-side support (e.g., MongoDB Atlas or Percona Server for MongoDB). It is not supported by the MongoDB Community Edition. Using explicit IAM credentials:username, password, and auth_mechanism_properties can be omitted:
GSSAPI (Kerberos)
GSSAPI/Kerberos is available for MongoDB Enterprise deployments only. It is not supported by MongoDB Community Edition. Using this mechanism requires:- The collector to be compiled with the
gssapibuild tag and cgo support (CGO_ENABLED=1). - On Linux, the
libkrb5library must be installed.
Note: The defaultotelcontribcolbinary is built without thegssapibuild tag and withCGO_ENABLED=0, so GSSAPI authentication will not work out of the box. You will need to build a custom collector withCGO_ENABLED=1and thegssapibuild tag to use this mechanism.
mongodb. Users can authenticate with an explicit password or by storing authentication keys in keytab files initialized with the kinit utility.
Resource attributes
server.address and server.port identify the monitored instance and are emitted by default. They
describe the location each scraped node reports for itself, not the configured hosts entry, so a
replica set emits a distinct pair per member. A node reports its port only when it is not the
default, so server.port is 27017 whenever no port is reported. Two instances on one machine
listening on different ports are therefore still told apart.
When a node reports a loopback address (localhost, 127.0.0.1 or ::1), server.address is the
host name of the machine running the collector. Loopback is only reachable when the instance is
co-located with the collector, so the collector host’s name is the instance’s real network identity;
reported verbatim, every monitored host would emit the same address. Any other address is reported
as given. If the collector host name cannot be determined, the loopback address is reported
unchanged and a warning is logged.
service.instance.id is a UUID v5 seeded from the same resolved address and port, so the two cannot
name different machines. Deployments whose nodes report a loopback address will see this identifier
change.
To stop emitting the server attributes, disable them individually:
Metrics
The following metrics are version-gated:mongodb.extent.count— MongoDB< 4.4with the MMAPv1 storage engine only.mongodb.wt.log.write,mongodb.wt.log.operation.count,mongodb.wt.log.sync.time,mongodb.wt.fsync.count, andmongodb.wt.concurrent_transaction.ticket.in_use— require the WiredTiger storage engine (the default since MongoDB 3.2; MMAPv1, the previous default, was removed in 4.2). No data points are emitted on other storage engines, such as the Enterprise-only inMemory engine.mongodb.wt.concurrent_transaction.ticket.in_useis additionally read fromserverStatus.wiredTiger.concurrentTransactions.{read,write}.outon MongoDB< 8.0, and fromserverStatus.queues.execution.{read,write}.outon MongoDB8.0+(the field was renamed in 8.0). The receiver probes both paths and uses whichever is present, so the same metric emits across all supported versions.
mongodb.oplog.*, mongodb.replica.*, and mongodb.replica_set.* metrics are only emitted by a
mongod that is a member of a replica set. They are skipped on a standalone deployment, on a mongos router, and
on a member whose replica set has not been initiated. They require the clusterMonitor role; if the
configured user lacks it, each scrape reports an authorization error for the enabled metrics rather
than skipping them. Where the role cannot be granted, such as on a managed service that restricts it,
leave these metrics disabled. mongodb.replica_set.lag and mongodb.replica_set.headroom are additionally only
emitted when the scraped member is the primary, which is the only member with an up-to-date view of
every other member’s replication progress.
mongodb.replica_set.member.count describes the whole replica set, so every scraped member reports
the same value. Do not sum it across members.
Details about the metrics produced by this receiver can be found in metadata.yaml
Feature gate configurations
See the Collector feature gates for an overview of feature gates in the collector. STABLE:receiver.mongodb.removeDatabaseAttr
The feature gate receiver.mongodb.removeDatabaseAttr will remove the database name attribute from data points
because it is already found on the resource. This feature gate cannot be changed and will be removed soon.
Metrics
Attributes
Resource Attributes
Configuration
Example Configuration
Last generated: 2026-10-05