# Packetbeat and Mongodb 4

**URL:** <https://discuss.elastic.co/t/packetbeat-and-mongodb-4/146302>\
**Category:** Beats\
**Tags:** packetbeat\
**Created:** [August 28, 2018, 8:58am UTC](https://discuss.elastic.co/t/packetbeat-and-mongodb-4/146302 "2018-08-28T08:58:14Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![tuthan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tuthan/32/34869_2.png) [@tuthan](https://discuss.elastic.co/u/tuthan)\
**Post date:** [August 28, 2018, 8:58am UTC](https://discuss.elastic.co/t/packetbeat-and-mongodb-4/146302/1 "2018-08-28T08:58:14Z")

</div>

Hi everyone,

I'm seeking for help here. I recently upgrade the mongodb to version 4. Since then seem i could not see any more traffic (Query, insert, update, find). There are bunch of `2018-08-28T15:55:50.264+0700	ERROR	mongodb/mongodb_parser.go:59	Unknown operation code: (value=2013)` in the log.  
Environment: `Mongodb 4 Packetbeat 6.1.2 then upgrade to 6.4 Elasticsearch 6.2.1`

Is there anyone out there have the same issue? I have tried play around with the configuration, upgrade beats but seem not helping at all.

---

<div class="post-metadata">

**Author:** ![cwurm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cwurm/32/34882_2.png) [@cwurm](https://discuss.elastic.co/u/cwurm)\
**Post date:** [August 28, 2018, 11:59pm UTC](https://discuss.elastic.co/t/packetbeat-and-mongodb-4/146302/2 "2018-08-28T23:59:54Z")

</div>

MongoDB added a [new `OP_MSG` opcode to its wire protocol](https://docs.mongodb.com/manual/reference/mongodb-wire-protocol/#request-opcodes) in version 3.6 that Packetbeat does not support as of now.

There [have been efforts](https://github.com/elastic/beats/issues/6191) to add new opcodes to the MongoDB protocol in Packetbeat, and hopefully that will eventually include this one as well.

---

<div class="post-metadata">

**Author:** ![tuthan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tuthan/32/34869_2.png) [@tuthan](https://discuss.elastic.co/u/tuthan)\
**Post date:** [August 29, 2018, 2:47am UTC](https://discuss.elastic.co/t/packetbeat-and-mongodb-4/146302/3 "2018-08-29T02:47:19Z")

</div>

Thanks Christoph.  
Do you know if the current packetbeat is working with MongoDB 4? The new opcode is only one issue. And not sure if this related to the one below.  
**My main issue is i can not see any other operations: insert, delete, update, find anymore since i update to 4. I looked around but seem there no one report this yet.**  
I can confirm my other server using mongodb 3.4 is still working fine. Sorry if i didn't write it clear.

---

<div class="post-metadata">

**Author:** ![cwurm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cwurm/32/34882_2.png) [@cwurm](https://discuss.elastic.co/u/cwurm)\
**Post date:** [August 29, 2018, 11:05am UTC](https://discuss.elastic.co/t/packetbeat-and-mongodb-4/146302/4 "2018-08-29T11:05:49Z")

</div>

I'm not sure if anybody else has tried it yet. From what I understand, the new `OP_MSG` opcode is intended to replace all others (there used to be separate opcodes for insert, update, etc.) so it's possible it wouldn't work with Mongo 4.0 without implementing this new addition to the protocol.

---

<div class="post-metadata">

**Author:** ![tuthan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tuthan/32/34869_2.png) [@tuthan](https://discuss.elastic.co/u/tuthan)\
**Post date:** [August 30, 2018, 8:55am UTC](https://discuss.elastic.co/t/packetbeat-and-mongodb-4/146302/5 "2018-08-30T08:55:30Z")

</div>

Yes, make sense now. I have tested on another MongoDB 4 deployment and can confirm also not seeing anything packetbeat too.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 27, 2018, 10:55am UTC](https://discuss.elastic.co/t/packetbeat-and-mongodb-4/146302/6 "2018-09-27T10:55:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
