# Mongodb\_parser.go:42: ERR Unknown operation code:

**URL:** <https://discuss.elastic.co/t/mongodb-parser-go-42-err-unknown-operation-code/82939>\
**Category:** Beats\
**Tags:** packetbeat\
**Created:** [April 19, 2017, 6:16pm UTC](https://discuss.elastic.co/t/mongodb-parser-go-42-err-unknown-operation-code/82939 "2017-04-19T18:16:09Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![PravinDwiwedi](https://avatars.discourse-cdn.com/v4/letter/p/b5ac83/32.png) [@PravinDwiwedi](https://discuss.elastic.co/u/PravinDwiwedi)\
**Post date:** [April 19, 2017, 6:16pm UTC](https://discuss.elastic.co/t/mongodb-parser-go-42-err-unknown-operation-code/82939/1 "2017-04-19T18:16:09Z")

</div>

Getting below error when started packetbeat for MongoDB--  
" mongodb\_parser.go:42: ERR Unknown operation code:"

Platform Details--

- Packetbeat- 5.3
- OS- LINUX 6.6 64bits
- MongoDB- 3.2
- Output- Elasticsearch 5.2.2

Note: Mongodb & Packetbeat both are running on the same server(LINUX 6.6 64bits).

Sample packetbeat.yml

packetbeat.protocols.mongodb:

# Configure the ports where to listen for MongoDB traffic. You can disable

# the MongoDB protocol by commenting out the list of ports.

ports: [27017]  
send\_request: true # index the request payload  
send\_response: true # index the response payload  
max\_docs: 10 # maximum number of documents to index per request/response  
max\_doc\_length: 1024 # maximum document size to index  
output.elasticsearch:

# Array of hosts to connect to.

hosts: ["[xxx.xx.xx.xxx:9200](http://xxx.xx.xx.xxx:9200)"]

Could you please guide me where I am making mistake? Any help/guidelines are highly appreciated.

Regards  
Pravin Dwiwedi

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [April 20, 2017, 10:22am UTC](https://discuss.elastic.co/t/mongodb-parser-go-42-err-unknown-operation-code/82939/2 "2017-04-20T10:22:51Z")

</div>

possible reasons for the error:

- op-code not implemented in packetbeat
- mongodb protocol changes (no idea)
- packetbeat TCP stream not in sync with actual TCP stream yet
- packet loss -\> packetbeat TCP stream not in sync

You have some more complete logs? Have you got a sample pcap (you can ask packetbeat to write packets to file or use tcpdump).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 18, 2017, 10:37am UTC](https://discuss.elastic.co/t/mongodb-parser-go-42-err-unknown-operation-code/82939/3 "2017-05-18T10:37:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.