Packetbeat and Mongodb 4

Elastic Stack Beats
1

Hi everyone,

I'm seeking for help here. I recently upgrade the mongodb to version 4. Since then seem i could not see any more traffic (Query, insert, update, find). There are bunch of 2018-08-28T15:55:50.264+0700 ERROR mongodb/mongodb_parser.go:59 Unknown operation code: (value=2013) in the log.
Environment: Mongodb 4 Packetbeat 6.1.2 then upgrade to 6.4 Elasticsearch 6.2.1

Is there anyone out there have the same issue? I have tried play around with the configuration, upgrade beats but seem not helping at all.

2

MongoDB added a new OP_MSG opcode to its wire protocol in version 3.6 that Packetbeat does not support as of now.

There have been efforts to add new opcodes to the MongoDB protocol in Packetbeat, and hopefully that will eventually include this one as well.

3

Thanks Christoph.
Do you know if the current packetbeat is working with MongoDB 4? The new opcode is only one issue. And not sure if this related to the one below.
My main issue is i can not see any other operations: insert, delete, update, find anymore since i update to 4. I looked around but seem there no one report this yet.
I can confirm my other server using mongodb 3.4 is still working fine. Sorry if i didn't write it clear.

4

I'm not sure if anybody else has tried it yet. From what I understand, the new OP_MSG opcode is intended to replace all others (there used to be separate opcodes for insert, update, etc.) so it's possible it wouldn't work with Mongo 4.0 without implementing this new addition to the protocol.

5

Yes, make sense now. I have tested on another MongoDB 4 deployment and can confirm also not seeing anything packetbeat too.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.