For AI agents: a documentation index is available at https://www.mongodb.com/docs/llms.txt — markdown versions of all pages are available by appending .md to any URL path.
Docs Menu
Docs Home
/ /
Export Logs
Docs Home
/
Management
/
Monitor Clusters
/
Export Logs
Docs Home
/
Management
/
Monitor Clusters
/
Export Logs

Export Logs to Splunk

You can configure your M10+ Atlas clusters to export system logs every minute to Splunk Cloud or Splunk Enterprise.

This integration allows you to:

  • Specify which MongoDB log files you want to export to Splunk. Atlas supports exporting the following log types:

    • mongod

    • mongos

    • mongod-audit

    • mongos-audit

  • Set up to 10 export paths, allowing you to export logs to multiple Splunk destinations simultaneously.

Important

Logs can contain sensitive information (including PII). You are responsible for the storage and treatment of your logs in your Splunk destination. To have Atlas redact certain information before exporting logs, contact MongoDB Support.

Required Access

To export logs to a Splunk destination, you must have Project Owner or Organization Owner access to Atlas.

Considerations

  • Each Atlas host typically produces 1 GB of logs per day. Exporting logs incurs a data transfer cost. The exact data transfer cost varies depending on the destination, region, and cloud provider.

  • Network issues or retries can cause duplicate log entries in your Splunk destination.

  • Atlas enforces TLS when connecting to external endpoints and requires certificates signed by a public Certificate Authority (CA). Self-signed certificates are not supported.

Prerequisites

You'll need:

  • A Splunk deployment with HTTP Event Collector (HEC) enabled.

  • A Splunk HEC endpoint URL.

  • A Splunk HEC token with permission to ingest events.

  • An M10+ Atlas cluster running MongoDB 7.0 or later.

Procedure

To export logs to Splunk, complete the following steps.

1

In Atlas, go to the Project Settings page.

  1. If it's not already displayed, select the organization that contains your desired project from the Organizations menu in the navigation bar.

  2. If it's not already displayed, select your desired project from the Projects menu in the navigation bar.

  3. In the sidebar, click the icon next to Project Overview.

The Project Settings page displays.

2

In Atlas, go to the Project Integrations page.

Click the Integrations tab.

The Project Integrations page displays.

3

Click Configure on the Splunk Monitoring card.

4

Connect Atlas to Splunk.

  1. In the HEC Token field, enter your Splunk HEC token.

  2. In the HEC URL field, enter your Splunk HEC URL.

  3. Under Log Type, select the types of logs you want to export.

    • MongoDB Logs Diagnostic logs written by each mongod server process. They record server startup and shutdown, configuration, connections, slow queries, replication, sharding activity, and other operational events.

    • MongoDB Audit Logs Auditing logs emitted by mongod that track system event actions such as authentication attempts, authorization checks, role changes, and other security-relevant operations. These logs are separate from the main MongoDB log.

    • MongoDB Router Logs Diagnostic logs written by each mongos router process in a sharded cluster. They capture router-specific behavior such as routing of queries to shards, sharding metadata refreshes, and general process diagnostics.

    • MongoDB Router Audit Logs Auditing logs emitted by mongos router processes, recording the same kinds of audited system events but from the router's perspective in a sharded deployment.

    To learn more, see View and Download MongoDB Logs.

  4. Click Test Integration to confirm your configuration and credentials are correct before enabling the export.

  5. Click Save.

Alerting for Log Export Failures

Atlas automatically notifies you when log exports fail or recover through default alerts that are enabled for all projects.

Default Alerts

The following alerts are enabled by default for all projects with External Log Sinks:

All alerts send email notifications to all users with the Project Owner role and appear in the Project Activity Feed. You can customize the notification recipients and methods in the Project Alerts settings.

Activity Feed Events

In addition to alerts, Atlas logs the following informational events to the Project Activity Feed:

  • Log export has recovered. Queued logs are ready to resume sending.

  • Log export has recovered. Queued logs are now being sent.

  • All queued logs have been delivered to sink.

To view these events, see View Activity Feed.

For more information about configuring alert notifications, see Configure an Alert.

Back
Export Logs to OpenTelemetry
Next
Push MongoDB Logs to AWS S3
Rate this page

On this page