/ /

Export Logs to AWS S3 Buckets

You can configure your M10+ Atlas clusters to export system logs every minute to an AWS S3 bucket.

This integration allows you to:

Specify which MongoDB log files you want to export to the S3 bucket. Atlas supports exporting the following log types:
- mongod
- mongos
- mongod-audit
- mongos-audit
Set up to 10 export paths, allowing you to export logs to multiple AWS S3 buckets simultaneously.
Send logs to an S3 Multi-Region Access Point (MRAP) by configuring the integration with the MRAP ARN. You can currently only configure MRAP ARNs using the Atlas Administration API. MRAP aliases are not supported.

Important

Logs can contain sensitive information (including PII). You are responsible for the storage and treatment of your logs in your AWS S3 bucket. To have Atlas redact certain information before exporting logs, contact MongoDB Support.

Required Access

To export logs to an AWS S3 bucket, you must have Project Owner or Organization Owner access to Atlas.

Considerations

Each Atlas host typically produces 1 GB of logs per day. Exporting logs incurs a data transfer cost. The exact data transfer cost varies depending on the destination, region, and cloud provider.
Network issues or retries can cause duplicate log entries in your AWS S3 bucket.
The AWS IAM role and the S3 bucket must belong to the same AWS account.

Prerequisites

You'll need:

An AWS IAM role with sts:AssumeRole that grants Atlas access to your AWS resource with a maximum session duration set to 12 hours.
An existing AWS S3 bucket.
An M10+ Atlas cluster running MongoDB 7.0 or later.

Procedure

To export logs to an AWS S3 bucket, complete the following steps.

In Atlas, go to the Project Settings page.

If it's not already displayed, select the organization that contains your desired project from the Organizations menu in the navigation bar.
If it's not already displayed, select your desired project from the Projects menu in the navigation bar.
In the sidebar, click the icon next to Project Overview.

The Project Settings page displays.

In Atlas, go to the Project Integrations page.

Click the Integrations tab.

The Project Integrations page displays.

Click Configure on the AWS S3 Log Monitoring card.

Grant Atlas access to your AWS account.

From the Authorize an AWS IAM Role dropdown, select your ARN. To add an ARN, see Set Up Unified AWS Access.
Click Next.

Connect Atlas to your AWS S3 bucket.

In the Bucket Name field, enter the name of your S3 bucket as it appears in your AWS account.
In the Prefix field, enter a directory name to organize the contents of your S3 bucket. For example, entering logs/ creates a logs directory in your S3 bucket to store the exported logs.
Under Log Type, select the types of logs you want to export.
- MongoDB Logs Diagnostic logs written by each mongod server process. They record server startup and shutdown, configuration, connections, slow queries, replication, sharding activity, and other operational events.
- MongoDB Audit Logs Auditing logs emitted by mongod that track system event actions such as authentication attempts, authorization checks, role changes, and other security-relevant operations. These logs are separate from the main MongoDB log.
- MongoDB Router Logs Diagnostic logs written by each mongos router process in a sharded cluster. They capture router-specific behavior such as routing of queries to shards, sharding metadata refreshes, and general process diagnostics.
- MongoDB Router Audit Logs Auditing logs emitted by mongos router processes, recording the same kinds of audited system events but from the router's perspective in a sharded deployment.
To learn more, see View and Download MongoDB Logs.
(Optional) If you want to encrypt the logs in your S3 bucket, enter your AWS Key Management Service (KMS) key ARN in the KMS Key field. To learn more, see Manage Customer Keys with AWS KMS.
Click Next.

Assign an access policy to your AWS IAM role.

Click to copy the access policy generated by Atlas and save it locally with the file name: AtlasS3LogExportPolicy.
Click to copy the CLI command generated by Atlas, then run the command in your terminal to attach the access policy to your AWS IAM role.
Click Validate to confirm your configuration and credentials are correct before enabling the export.

Click Finish.

Exported Log Format

Atlas exports logs to your S3 bucket as JSON objects with structured metadata. Each log entry includes the original MongoDB log message along with additional context fields that identify the source cluster, host, and log type.

The exported logs use a structured format that differs from the legacy Push-Based Log Export (PBLE) system. This new format provides enhanced metadata for log routing, filtering, and analysis in your logging infrastructure.

Log Entry Structure

Each exported log entry is a JSON object with the following top-level fields:

Field	Description
`service.name`	String that identifies the service type. Default set to `mongodb`.
`log`	Original MongoDB log message as a JSON-encoded string. This contains the structured log data from MongoDB, including fields like `t` (timestamp), `s` (severity), `c` (component), `id` (message ID), `ctx` (context), `msg` (message text), and `attr` (attributes).
`host.name`	Fully qualified domain name of the MongoDB host that generated the log entry (e.g., `atlas-cluster-shard-00-00.example.mongodb.net`).
`mongodb.group.id`	Atlas project ID (also known as group ID) that contains the cluster.
`mongodb.cluster.name`	Internal cluster identifier that Atlas uses.
`mongodb.customer.cluster.name`	User-defined cluster name as it appears in the Atlas UI.
`mongodb.log.type`	Type of log being exported. Possible values: `mongod`, `mongos`, `mongod-audit`, `mongos-audit`.
`timestamp`	ISO 8601 timestamp when the log entry was generated.

Example Log Entry

The following example shows a typical exported log entry:

{
  "service.name": "mongodb",
  "log": "{\"t\":{\"$date\":\"2026-05-19T21:58:00.309+00:00\"},\"s\":\"I\",\"c\":\"NETWORK\",\"id\":6723804,\"ctx\":\"conn928\",\"msg\":\"Ingress TLS handshake complete\",\"attr\":{\"durationMillis\":26}}",
  "host.name": "atlas-cluster-shard-00-00.nzmz4k.mongodb.net",
  "mongodb.group.id": "682f18ee72a6a02c8182cab3",
  "mongodb.cluster.name": "atlas-cluster",
  "mongodb.customer.cluster.name": "Cluster0",
  "mongodb.log.type": "mongod",
  "timestamp": "2026-05-19T21:58:00.309Z"
}

The log field contains the original MongoDB log message. When parsed, it reveals the standard MongoDB log message structure:

{
  "t": {"$date": "2026-05-19T21:58:00.309+00:00"},
  "s": "I",
  "c": "NETWORK",
  "id": 6723804,
  "ctx": "conn928",
  "msg": "Ingress TLS handshake complete",
  "attr": {
    "durationMillis": 26
  }
}

Note

The ordering of fields within the attr object may vary between log entries and may differ from the legacy PBLE format. Your log parsing tools should not rely on field order within attr.

Changes from Push-Based Log Export (PBLE)

The External Log Sink format includes several changes from the legacy Push-Based Log Export (PBLE) system:

Change	Description
Nested log content	MongoDB log message is now nested under the `log` field as a JSON-encoded string, rather than being at the top level. This requires an additional JSON parsing step to extract the log message fields.
Additional metadata fields	New top-level fields provide context about the log source: `service.name`, `host.name`, `mongodb.group.id`, `mongodb.cluster.name`, `mongodb.customer.cluster.name`, `mongodb.log.type`, and `timestamp`.
Log entry ordering	Order in which log entries appear in S3 may differ from PBLE. Do not rely on log entry ordering for temporal analysis. Use the `timestamp` field or the `t.$date` field within the `log` content for accurate time-based processing.
Attribute field ordering	Order of fields within the `attr` object may differ from PBLE. Parse `attr` as a JSON object without relying on field order.

Parsing Considerations

When processing exported logs:

Two-level JSON parsing: First parse the outer JSON object to access metadata fields, then parse the log field as JSON to access the MongoDB log message.
Field extraction: To extract specific MongoDB log fields (like msg, c, or attr), parse the log field first.
Timestamp handling: The top-level timestamp field uses ISO 8601 format, while the t.$date field within the log content may use MongoDB's Extended JSON format. Both represent the same time.
Cluster identification: Use mongodb.customer.cluster.name to filter logs by the cluster name shown in Atlas UI. The mongodb.cluster.name field contains an internal identifier.

Alerting for Log Export Failures

Atlas automatically notifies you when log exports fail or recover through default alerts that are enabled for all projects.

Default Alerts

The following alerts are enabled by default for all projects with External Log Sinks:

All alerts send email notifications to all users with the Project Owner role and appear in the Project Activity Feed. You can customize the notification recipients and methods in the Project Alerts settings.

Activity Feed Events

In addition to alerts, Atlas logs the following informational events to the Project Activity Feed:

Log export has recovered. Queued logs are ready to resume sending.
Log export has recovered. Queued logs are now being sent.
All queued logs have been delivered to sink.

To view these events, see View Activity Feed.

For more information about configuring alert notifications, see Configure an Alert.

Back

Export Logs

Export Logs to Azure Blob Storage