How Packetbeat for MongoDB

Elastic Stack Beats
1

i Packetbeat for MongoDB，but not find mongodb.query information。only have mongodb.startingFrom mongodb.numberToReturn mongodb.numberToSkip mongodb.fullCollectionName mongodb.cursorId，but not data。 why？ my version is 7.14

Packetbeat for mysql，look Packetbeat log find “WARN mysql/mysql.go:284 MySQL Message too short. Ignore it.” why？

2

Hi,

For mongodb, a missing query can indicate that only one side of traffic is being captured, or packet loss.

For mysql, it's difficult to tell why you're getting this error.

It'll be easier to diagnose the problem by writing the packets to a pcap file by using the --dump file.pcap argument for packetbeat and then analyze this file. You can upload it here (if it doesn't contain sensitive information) or send it to me via private message if you want me to look at it.

Packetbeat has to be run for enough time so that the problems appear.

3

Thank you, I found that it was a problem with the mysql client tool (use Webyog SQLyog tool，packetbeat log find “WARN mysql/mysql.go:284 MySQL Message too short. Ignore it.” ).
and found The es index is PacketBeat -7.14.0-2021.09.02-000001, how can I make it generate a new index by time every day?
mongodb client Execute query statement "db.replaceRootExample.find()",but in Dashboard “Top slowest MongoDB queries [Packetbeat] ECS” not found this statement ，in “Top slowest MongoDB queries [Packetbeat] ECS” is only show " ngiam-db.$cmd.otherCommand(); admin.$cmd.saslStart().limit(1);
admin.$cmd.saslContinue().limit(1);
admin.$cmd.otherCommand().limit(1);
admin.$cmd.otherCommand()",why?

4

Have a look at the docs about Index Lifecycle Management.

5

mongodb client Execute query statement "db.replaceRootExample.find()", mongodb version is 4.2，
but in Dashboard “Top slowest MongoDB queries [Packetbeat] ECS” not found this statement ，
in “Top slowest MongoDB queries [Packetbeat] ECS” is only show " ngiam-db.$cmd.otherCommand();
admin.$cmd.saslStart().limit(1);
admin.$cmd.saslContinue().limit(1);
admin.$cmd.otherCommand().limit(1);
admin.$cmd.otherCommand()",why?

6

who can help me？

7

No one reply ？？？？？？why？

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.