# MongoDB r4.2.25 src/mongo/logger/message_event_utf8_encoder.cpp: date, severity, component, "[context] " when there is one, then the message; log_severity.cpp toStringDataCompact: F E W I, D1 to D5, U for unknown
# MongoDB 4.4 and later write JSON lines instead ({"t":…,"s":…,"c":…,"msg":…}), which the JSON reader takes
# Lines from Elastic beats v9.5.5 filebeat/module/mongodb/log/test
2018-02-05T13:44:56.657+0100 I CONTROL  [initandlisten] db version v3.2.11 ⇒ {"rule": "mongodb", "level": "info", "leveled": true, "name": "CONTROL", "message": "db version v3.2.11", "prefixed": true}
2018-02-05T13:44:56.657+0100 I CONTROL  [initandlisten] MongoDB starting : pid=29803 port=27017 dbpath=/var/lib/mongodb 64-bit host=sleipnir ⇒ {"rule": "mongodb+kv", "level": "info", "leveled": true, "name": "CONTROL", "message": "MongoDB starting : pid=29803 port=27017 dbpath=/var/lib/mongodb 64-bit host=sleipnir"}
2018-02-05T13:44:56.657+0100 I CONTROL  [initandlisten]     distarch: x86_64 ⇒ {"rule": "mongodb", "level": "info", "name": "CONTROL", "message": "    distarch: x86_64"}
2018-02-05T13:44:56.677+0100 I STORAGE  [initandlisten] wiredtiger_open config: create,cache_size=8G,session_max=20000,eviction=(threads_max=4),config_base=false,statistics=(fast),log=(enabled=true,archive=true,path=journal,compressor=snappy),file_manager=(close_idle_time=100000),checkpoint=(wait=60,log_size=2GB),statistics_log=(wait=0), ⇒ {"rule": "mongodb+kv", "level": "info", "name": "STORAGE", "message": "wiredtiger_open config: create,cache_size=8G,session_max=20000,eviction=(threads_max=4),config_base=false,statistics=(fast),log=(enabled=true,archive=true,path=journal,compressor=snappy),file_manager=(close_idle_time=100000),checkpoint=(wait=60,log_size=2GB),statistics_log=(wait=0),"}
2018-02-05T13:44:56.724+0100 I FTDC     [initandlisten] Initializing full-time diagnostic data capture with directory '/var/lib/mongodb/diagnostic.data' ⇒ {"rule": "mongodb", "level": "info", "name": "FTDC", "message": "Initializing full-time diagnostic data capture with directory '/var/lib/mongodb/diagnostic.data'"}
2018-02-05T13:44:56.744+0100 I NETWORK  [initandlisten] waiting for connections on port 27017 ⇒ {"rule": "mongodb", "level": "info", "name": "NETWORK", "message": "waiting for connections on port 27017"}
2018-02-05T13:50:55.170+0100 I NETWORK  [conn1] end connection 127.0.0.1:55404 (0 connections now open) ⇒ {"rule": "mongodb", "level": "info", "name": "NETWORK", "message": "end connection 127.0.0.1:55404 (0 connections now open)"}
2018-02-05T14:49:45.688+0100 I CONTROL  [signalProcessingThread] dbexit:  rc: 0 ⇒ {"rule": "mongodb", "level": "info", "name": "CONTROL", "message": "dbexit:  rc: 0"}
2019-03-07T15:10:26.960+0000 I ASIO [NetworkInterfaceASIO-Replication-0] Successfully connected to dbbox7:27017, took 10ms (1 connections now open to dbbox7:27017) ⇒ {"rule": "mongodb", "level": "info", "name": "ASIO", "message": "Successfully connected to dbbox7:27017, took 10ms (1 connections now open to dbbox7:27017)"}
2020-03-31T21:19:46.942+0000 E WRITE  [initandlisten] ** ERROR: A write operation resulted in an error. E11000 duplicate key error index: test.people.$_id_ dup key: { : 0 } ⇒ {"rule": "mongodb", "level": "error", "name": "WRITE", "message": "** ERROR: A write operation resulted in an error. E11000 duplicate key error index: test.people.$_id_ dup key: { : 0 }"}
2020-03-31T21:19:47.420+0000 E NETWORK  [initandlisten] ** ERROR: No connection could be made because the target machine actively refused it 127.0.0.1:27017 at System.Net.Sockets.Socket.EndConnect ⇒ {"rule": "mongodb", "level": "error", "name": "NETWORK", "message": "** ERROR: No connection could be made because the target machine actively refused it 127.0.0.1:27017 at System.Net.Sockets.Socket.EndConnect"}
# constructed 2026-10-21T14:03:01.123+0000 W NETWORK  [conn7] Error sending response to client: SocketException: Broken pipe ⇒ {"rule": "mongodb", "level": "warn", "name": "NETWORK", "message": "Error sending response to client: SocketException: Broken pipe"}
# constructed 2026-10-21T14:03:01.123+0000 F -        [main] Failed global initialization: FileNotOpen: Failed to open "/var/log/mongodb/mongod.log" ⇒ {"rule": "mongodb", "level": "critical", "name": "", "message": "Failed global initialization: FileNotOpen: Failed to open \"/var/log/mongodb/mongod.log\""}
# constructed 2026-10-21T14:03:01.123Z D1 COMMAND  [conn7] run command admin.$cmd { isMaster: 1 } ⇒ {"rule": "mongodb", "level": "debug", "name": "COMMAND", "message": "run command admin.$cmd { isMaster: 1 }"}
# constructed 2026-10-21T14:03:01.123Z D5 QUERY    [conn7] Beginning planning ⇒ {"rule": "mongodb", "level": "debug", "name": "QUERY", "message": "Beginning planning"}
# constructed 2026-10-21T14:03:01.123+0000 I  REPL     [replexec-0] Member bench-1:27017 is now in state SECONDARY ⇒ {"rule": "mongodb", "level": "info", "name": "REPL", "message": "Member bench-1:27017 is now in state SECONDARY"}
# constructed 2026-10-21T14:03:01.123+0000 I CONTROL  no context ⇒ {"rule": "mongodb", "level": "info", "name": "CONTROL", "message": "no context"}
# constructed 2026-10-21T14:03:01.123+0000 U STORAGE  [initandlisten] an unknown severity ⇒ {"rule": "mongodb", "level": "info", "leveled": false, "name": "STORAGE", "message": "an unknown severity"}
# a severity MongoDB does not print, a stamp of another shape, and other formats
# constructed 2026-10-21T14:03:01.123+0000 X CONTROL  [initandlisten] X is no severity ⇒ {"rule": "plain", "level": "info", "leveled": false, "message": "2026-10-21T14:03:01.123+0000 X CONTROL  [initandlisten] X is no severity"}
# constructed 2026-10-21T14:03:01.123+0000 D6 CONTROL  [initandlisten] five debug levels ⇒ {"rule": "plain", "level": "info", "leveled": false, "message": "2026-10-21T14:03:01.123+0000 D6 CONTROL  [initandlisten] five debug levels"}
# constructed 2026-10-21T14:03:01.123+0000 I control  [initandlisten] lower case component ⇒ {"rule": "plain", "level": "info", "leveled": false, "message": "2026-10-21T14:03:01.123+0000 I control  [initandlisten] lower case component"}
# constructed 2026-10-21 14:03:01.123+0000 I CONTROL  [initandlisten] a space in the stamp ⇒ {"rule": "plain", "level": "info", "leveled": false, "message": "2026-10-21 14:03:01.123+0000 I CONTROL  [initandlisten] a space in the stamp"}
# constructed 2026-10-21T14:03:01+0000 I CONTROL  [initandlisten] no milliseconds ⇒ {"rule": "plain", "level": "info", "leveled": false, "message": "2026-10-21T14:03:01+0000 I CONTROL  [initandlisten] no milliseconds"}
# constructed 2026-10-21T14:03:01.123+0000 INFO CONTROL  [initandlisten] a level word is a layout ⇒ {"rule": "layout", "level": "info", "message": "CONTROL  [initandlisten] a level word is a layout"}
# constructed 2026-10-21T14:03:01.123+0000 I ⇒ {"rule": "plain", "level": "info", "leveled": false, "message": "2026-10-21T14:03:01.123+0000 I"}
{"t":{"$date":"2021-03-22T21:21:20.349+00:00"},"s":"I",  "c":"STORAGE",  "id":4615611, "ctx":"initandlisten","msg":"MongoDB starting","attr":{"pid":1,"port":27017,"dbPath":"/data/db","architecture":"64-bit","host":"6150fe65a89c"}} ⇒ {"rule": "json", "level": "info", "leveled": true, "name": "STORAGE", "message": "MongoDB starting"}
2019-03-24T13:44:25.484123Z 0 [System] [MY-013169] [Server] /usr/sbin/mysqld (mysqld 8.0.15) initializing of server in progress as process 1640 ⇒ {"rule": "mysql", "level": "info", "name": "Server", "message": "/usr/sbin/mysqld (mysqld 8.0.15) initializing of server in progress as process 1640"}
# constructed 2026-10-21T14:03:01.123456789Z stdout F I CONTROL  [initandlisten] hello ⇒ {"rule": "container", "level": "info", "leveled": false, "message": "I CONTROL  [initandlisten] hello"}
