The mongo logs have a lot of varied information and, as a result, lack a consistent structure. This makes writing accurate and efficient parsers difficult because your parser has to understand how the line will be printed in each context. For instance, queries are logged very differently from updates:
Tue Feb 17 21:19:53.300 [conn947952] update foo.bar query: { _id: "abc" } update: { $set: { x: 0 } } nscanned:1 nscannedObjects:1 nMatched:1 nModified:1 keyUpdates:0 numYields:0 locks(micros) w:168 0ms
vs.
Tue Feb 17 21:19:53.301 [conn927275] query foo.bar query: { $query: { _id: "abc" } } planSummary: COLLSCAN ntoreturn:100 ntoskip:0 nscanned:1 nscannedObjects:1 keyUpdates:0 numYields:0 locks(micros) r:93 nreturned:1 reslen:521 0ms
Outside of the realm of op queries, the lines get even more diverse:
Fri Feb 20 21:56:12.332 [initandlisten] connection accepted from 127.0.0.1:48345 #6552246 (5768 connections now open)
Fri Feb 20 21:57:02.003 [conn6479488] getmore local.oplog.rs cursorid:901395238872875 ntoreturn:0 keyUpdates:0 numYields:0 locks(micros) r:40 nreturned:1 reslen:201 4ms
Fri Feb 20 21:57:42.989 [conn6549710] Plan 2 involved in multi-way tie. ns: data.foo query: { foo: "bar" } sort: {} projection: {} skip: 0 limit: 0 score: 1.5003 summary: IXSCAN { foo: 1 }
This type of data seems like a good candidate for JSON formatting. It would be helpful to have a config option for having all log lines printed in JSON. This would make parsing straightforward and consistent regardless of the presence or absence of various fields.
{ "time": "Tue Feb 17 21:19:53.301", "thread": "conn927275", "op": "query", "ns": "foo.bar", "query": "{ $query: { _id: \"abc\" } }", "planSummary": "COLLSCAN", "ntoreturn":100, "ntoskip":0, "nscanned":1, "nscannedObjects":1, "keyUpdates":0, "numYields":0, "locks(micros)" : { "r":93 }, "nreturned":1, "reslen":521, "duration_ms":0 }
- is duplicated by
-
SERVER-21857 Mongodb output log as json?
-
- Closed
-