There are several cases where a command or its payload won't be published via the command monitoring mechanism:

• The command is a handshake command (ismaster/hello) on a non-monitoring connection - no event is published at all (probably because this isn't useful to applications in general)
• The command belongs to the redacted set of commands or contains keys triggering payload redaction (primarily authentication commands but there are others like copydb) - empty payload provided by default for security reasons, full payload may be retrieved by setting UNREDACT environment variable
• The command is an ismaster/hello on a monitoring connection - these commands publish heartbeat events but not command monitoring events, the heartbeat events do not include command or reply payloads

I suggest adding this to the user documentation under command monitoring for clarity.