Update MongoDB protocol with new opcodes

Please post all questions and issues on https://discuss.elastic.co/c/beats before opening a Github Issue. Your questions will reach a wider audience there, and if we confirm that there is a bug, then you can open a new issue.

For security vulnerabilities please only send reports to security@elastic.co. See https://www.elastic.co/community/security for more information.

For confirmed bugs, please report:

• Version: packetbeat-6.1.2-linux-x86_64
• Operating System: Linux contents-mongo-dev-01 4.9.20-11.31.amzn1.x86_64 #1 SMP Thu Apr 13 01:53:57 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
• Mongodb Version: db version v3.2.13
• Steps to Reproduce:

[root@contents-mongo-dev-01 packetbeat-6.1.2-linux-x86_64]# /beat/packetbeat-6.1.2-linux-x86_64/packetbeat -c /beat/packetbeat-6.1.2-linux-x86_64/packetbeat.yml -e

Q) When packetbeat is executed, the following error occurs.

2018/01/26 06:30:01.311175 mongodb_parser.go:42: ERR Unknown operation code: 2018/01/26 06:30:01.311872 mongodb_parser.go:42: ERR Unknown operation code: 2018/01/26 06:30:01.311902 mongodb_parser.go:42: ERR Unknown operation code: 2018/01/26 06:30:01.311928 mongodb_parser.go:42: ERR Unknown operation code: 2018/01/26 06:30:01.403019 mongodb_parser.go:42: ERR Unknown operation code: 2018/01/26 06:30:01.403631 mongodb_parser.go:42: ERR Unknown operation code:

Q) My setup is as below and I simply linked it to the logstash. Please check the cause of the above error.

[root@contents-mongo-dev-01 packetbeat-6.1.2-linux-x86_64]# cat packetbeat.yml | grep -v '#'

packetbeat.interfaces.device: any

packetbeat.flows: timeout: 30s period: 10s

packetbeat.protocols:

• type: mongodb ports: [27017] send_request: true send_response: true max_docs: 0 max_doc_length: 0

setup.template.settings: index.number_of_shards: 3 setup.kibana:

output.elasticsearch: hosts: ["internal-bh-elasticsearch-lb-1602908268.ap-northeast-2.elb.amazonaws.com:9200"]

logging.level: error