> For the complete MongoDB documentation index, see www.mongodb.com/docs/llms.txt # Export Activity Feed Events to External Tools You can stream events from the Atlas [Activity Feed](https://www.mongodb.com/docs/atlas/tutorial/activity-feed.md#std-label-activity-feed) to external tools, including Datadog, Splunk, customer-managed cloud storage, and any OpenTelemetry (OTel)-compatible destination. Exporting events enables centralized audit logging, long-term retention, and integration with your existing monitoring and observability tools. You can configure event export at the following levels: - **Project**: exports events from the Project Activity Feed. - **Organization**: exports events from the Organization Activity Feed. Unlike [system log export](https://www.mongodb.com/docs/atlas/export-logs.md#std-label-export-logs), event export doesn't require an `M10+` cluster. Event export supports clusters of all tiers, including free and shared-tier clusters. ## Supported Destinations The available destinations depend on whether you configure the integration for a project or an organization. Project event export supports all log export destinations. In the initial release, organization event export supports only OTel-compatible destinations. | Destination | Project Events | Organization Events | | --- | --- | --- | | [AWS S3](https://www.mongodb.com/docs/atlas/export-logs-external-sinks.md#std-label-export-logs-external-sinks) | Yes | No | | [Azure Blob Storage](https://www.mongodb.com/docs/atlas/export-logs-azure.md#std-label-export-logs-azure) | Yes | No | | [Datadog](https://www.mongodb.com/docs/atlas/export-logs-datadog.md#std-label-export-logs-datadog) | Yes | No | | [Google Cloud Storage](https://www.mongodb.com/docs/atlas/export-logs-gcs.md#std-label-export-logs-gcs) | Yes | No | | [OpenTelemetry](https://www.mongodb.com/docs/atlas/export-logs-otel.md#std-label-export-logs-otel) | Yes | Yes | | [Splunk](https://www.mongodb.com/docs/atlas/export-logs-splunk.md#std-label-export-logs-splunk) | Yes | No | ## Required Access - To configure event export for a project, you must have [`Project Owner`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Project-Owner) access to the project. - To configure event export for an organization, you must have [`Organization Owner`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Organization-Owner) access to the organization. ## Configure Project Event Export To export project-level events, follow the configuration procedure for your destination and select Events under Log Type when prompted: - [AWS S3](https://www.mongodb.com/docs/atlas/export-logs-external-sinks.md#std-label-export-logs-external-sinks) - [Azure Blob Storage](https://www.mongodb.com/docs/atlas/export-logs-azure.md#std-label-export-logs-azure) - [Datadog](https://www.mongodb.com/docs/atlas/export-logs-datadog.md#std-label-export-logs-datadog) - [Google Cloud Storage](https://www.mongodb.com/docs/atlas/export-logs-gcs.md#std-label-export-logs-gcs) - [OpenTelemetry](https://www.mongodb.com/docs/atlas/export-logs-otel.md#std-label-export-logs-otel) - [Splunk](https://www.mongodb.com/docs/atlas/export-logs-splunk.md#std-label-export-logs-splunk) You can combine Events with system log types in the same integration, or create separate integrations for logs and events. ## Configure Organization Event Export Organization-level integrations export events only and support only OTel-compatible destinations. To configure an organization-level integration, see [Export Organization Activity Feed Events.](https://www.mongodb.com/docs/atlas/export-logs-otel.md#std-label-export-logs-otel-org-events) ## Configure Event Export with the API To configure event export programmatically, use the log integration endpoints of the Atlas Administration API. To export events, set `logTypes` to include `EVENTS`. | Method | Endpoint | Description | | --- | --- | --- | | `POST` | `/api/atlas/v2/groups/{groupId}/logIntegrations` | Creates one project-level log integration. | | `GET` | `/api/atlas/v2/groups/{groupId}/logIntegrations` | Returns all project-level log integrations. | | `GET` | `/api/atlas/v2/groups/{groupId}/logIntegrations/{id}` | Returns one project-level log integration. | | `PUT` | `/api/atlas/v2/groups/{groupId}/logIntegrations/{id}` | Updates one project-level log integration. | | `DELETE` | `/api/atlas/v2/groups/{groupId}/logIntegrations/{id}` | Removes one project-level log integration. | | `POST` | `/api/atlas/v2/orgs/{orgId}/logIntegrations` | Creates one organization-level log integration. | | `GET` | `/api/atlas/v2/orgs/{orgId}/logIntegrations` | Returns all organization-level log integrations. | | `GET` | `/api/atlas/v2/orgs/{orgId}/logIntegrations/{id}` | Returns one organization-level log integration. | | `PUT` | `/api/atlas/v2/orgs/{orgId}/logIntegrations/{id}` | Updates one organization-level log integration. | | `DELETE` | `/api/atlas/v2/orgs/{orgId}/logIntegrations/{id}` | Removes one organization-level log integration. | **Note:** The organization-level endpoints are available in the preview version of the Atlas Administration API. To use them, set the `Accept` header to `application/vnd.atlas.preview+json`. Organization-level integrations support only the `OTEL_LOG_EXPORT` integration type and the `EVENTS` log type. Responses redact header values. When you update an integration, sending a redacted value back unchanged leaves the stored value in place. Supply a header value in full only when you change it. ### Example: Create a Project Event Export Integration The following example creates a project-level OpenTelemetry integration that exports Activity Feed events: ```sh curl --header "Authorization: Bearer {ACCESS-TOKEN}" \ --header "Content-Type: application/json" \ --header "Accept: application/vnd.atlas.2025-03-12+json" \ --include \ --request POST "https://cloud.mongodb.com/api/atlas/v2/groups/{PROJECT-ID}/logIntegrations?pretty=true" \ --data '{ "type": "OTEL_LOG_EXPORT", "logTypes": ["EVENTS"], "otelEndpoint": "https://otel-collector.example.com:4318/v1/logs", "otelSuppliedHeaders": [ { "name": "Authorization", "value": "Bearer token123" } ] }' ``` ### Example: Create an Organization Event Export Integration The following example creates an organization-level OpenTelemetry integration that exports Activity Feed events: ```sh curl --header "Authorization: Bearer {ACCESS-TOKEN}" \ --header "Content-Type: application/json" \ --header "Accept: application/vnd.atlas.preview+json" \ --include \ --request POST "https://cloud.mongodb.com/api/atlas/v2/orgs/{ORG-ID}/logIntegrations?pretty=true" \ --data '{ "type": "OTEL_LOG_EXPORT", "logTypes": ["EVENTS"], "otelEndpoint": "https://otel-collector.example.com:4318/v1/logs", "otelSuppliedHeaders": [ { "name": "Authorization", "value": "Bearer token123" } ] }' ``` The endpoint returns the created integration: ```json { "id": "66d9f3e1a2b3c4d5e6f70819", "type": "OTEL_LOG_EXPORT", "logTypes": ["EVENTS"], "otelEndpoint": "https://otel-collector.example.com:4318/v1/logs", "otelSuppliedHeaders": [ { "name": "Authorization", "value": "" } ] } ``` ## Event Format Atlas delivers events to your destination as JSON (Javascript Object Notation) payloads over OTLP/HTTP. Each exported event is an OTLP log record. The record's resource includes a `service.name` attribute set to `mongodb-atlas-events`, which identifies the Activity Feed event stream, so your OTel collector can route these events separately from other telemetry. Atlas omits attributes with null values from exported events. Each exported event includes the following fields: | Field | Description | | --- | --- | | `timeUnixNano` | Time when the event occurred, in nanoseconds since the Unix epoch. | | `severityText` | Severity of the event as text, such as `INFO`. Corresponds to the event severity shown in the Activity Feed. | | `severityNumber` | Severity of the event as an OTLP severity number enum, such as `SEVERITY_NUMBER_INFO`. | | `body.stringValue` | JSON-encoded event object. Contains the event ID (`_id`), event type (`eventType`), creation time in milliseconds since the Unix epoch (`createdDate`), project ID (`projectId`, when applicable), and event-specific details (`eventPayload`). The `source` object identifies what initiated the event, such as a `sourceType` of `USER` and a `sourceInfo` object with the `username`. | | `mongodb.event.id` attribute | Unique identifier for the event. Use this field to deduplicate events. | | `mongodb.event.type` attribute | Activity Feed event type. For the list of event types, see [Atlas Alert Event Types.](https://www.mongodb.com/docs/atlas/reference/atlas-alert-event-types.md#std-label-atlas-alert-event-types) | | `mongodb.event.payload.encoding` attribute | Encoding of the event payload in `body.stringValue`, such as `json`. | | `mongodb.org.id` attribute | ID of the organization where the event occurred. Always present for organization-level exports. Present on some project-level events. | | `mongodb.project.id` attribute | ID of the project where the event occurred. Always present for project-level exports. Present on some organization-level events. | The following example shows an exported project event: ```json { "timeUnixNano": "1788896817574000000", "severityNumber": "SEVERITY_NUMBER_INFO", "severityText": "INFO", "body": { "stringValue": "{\"_id\":\"6aa06631ba29fc2b0f206c32\",\"eventType\":\"/events/mms/alerts/alert_config_added_audit\",\"projectId\":\"62abb98d95a82610b74debc5\",\"createdDate\":1788896817574,\"resources\":[],\"eventPayload\":\"{\\\"targetAlertConfigId\\\": \\\"6aa06631ba29fc2b0f206c30\\\", \\\"targetAlertConfigEventType\\\": \\\"HOST_DOWN\\\", \\\"targetAlertConfigType\\\": \\\"HOST\\\"}\",\"source\":{\"sourceType\":\"USER\",\"sourceInfo\":{\"username\":\"Atlas Admin\"}}}" }, "attributes": [ { "key": "mongodb.event.id", "value": { "stringValue": "6aa06631ba29fc2b0f206c32" } }, { "key": "mongodb.event.type", "value": { "stringValue": "/events/mms/alerts/alert_config_added_audit" } }, { "key": "mongodb.project.id", "value": { "stringValue": "62abb98d95a82610b74debc5" } }, { "key": "mongodb.event.payload.encoding", "value": { "stringValue": "json" } } ] } ``` ## Delivery Behavior - **Near real time.** Under normal conditions, Atlas delivers events in near real time. Batches flush approximately once per minute. - **At-least-once delivery.** Atlas might deliver the same event more than once. Deduplicate events by using the unique `mongodb.event.id` field. - **Buffering during outages.** If your destination is unavailable, Atlas buffers events and retries delivery. Atlas retains undelivered events for up to seven days. Events that remain undelivered after seven days are permanently deleted. - **No automatic replay, backfill, or failure alerts.** The initial release doesn't automatically replay events after persistent failures and doesn't backfill historical events that occurred before you configured the integration. To request redelivery of events after a persistent failure, contact [MongoDB Support](https://support.mongodb.com/welcome). ## Destination Limits | Destination | Limits | | --- | --- | | Datadog | Datadog accepts up to 5 MB and 1,000 events per request. | | Splunk | Splunk ingests events in batches through the HTTP Event Collector (HEC). If one event in a batch is malformed, Splunk rejects the entire batch. | | OpenTelemetry | Delivery depends on the availability and configuration of your OTel collector. Endpoints must use HTTPS (Secure HyperText Transport Protocol) with a certificate signed by a public Certificate Authority (CA). Endpoint URLs can be up to 2,048 characters. You can configure up to 10 headers with a combined size of up to 2 KB. | ## Pricing Event export has no separate SKU or per-feature charge. However, exporting events can incur data transfer charges, which vary by destination, region, and cloud provider. To learn more, see [Data Transfer Costs.](https://www.mongodb.com/docs/atlas/billing/data-transfer-costs.md#std-label-data-transfer-costs) ## Learn More - [View the Activity Feed](https://www.mongodb.com/docs/atlas/tutorial/activity-feed.md#std-label-activity-feed) - [Export system logs to external services](https://www.mongodb.com/docs/atlas/export-logs.md#std-label-export-logs) - [Atlas event types](https://www.mongodb.com/docs/atlas/reference/atlas-alert-event-types.md#std-label-atlas-alert-event-types) - [Atlas Administration API Specification](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/)