MongoDB sources are read with change streams, which tail the replica set's oplog for every insert, update, and delete. Initial load is a chunked, resumable scan sorted by _id, and schema is inferred by sampling live documents — MongoDB has no catalog to read.
Supported deployments
The same connector serves self-hosted MongoDB replica sets and MongoDB Atlas. An Atlas cluster is a replica set, so change streams work unchanged; the connection string and the user's privileges are the only differences.
Prerequisites
A replica set is required
Change streams do not work on a standalone mongod. Fabric refuses a deployment with no replica set name. The one exception is a documented single-node development deployment, enabled with the Direct connection checkbox — never use that against a production topology.
User privileges
The connection's user needs three actions on the target database: find, changeStream, and listCollections. A read role alone is not enough — changeStream is a separate action.
// mongosh, as a user with userAdmin on the target db
db.getSiblingDB("myapp").createRole({
role: "fabricCdc",
privileges: [{
resource: { db: "myapp", collection: "" },
actions: ["find", "changeStream", "listCollections"]
}],
roles: []
})
db.getSiblingDB("myapp").createUser({
user: "fabric",
pwd: "<password>",
roles: [{ role: "fabricCdc", db: "myapp" }]
})Oplog retention
A change-stream resume token can expire if the oplog rolls over. Keep at least 24 hours of oplog history:
db.adminCommand({ setParameter: 1, oplogMinRetentionHours: 24 })Network
The driver must reach every replica-set member, not just one host, unless direct connection is enabled. A mongodb+srv:// URI also needs DNS SRV resolution from the Fabric host.
Connection fields
| Field | Required | Default | Notes |
|---|---|---|---|
| Connector name | Yes | — | Unique across sources. |
| Connection string | Yes on create | — | Credentials go in the URI — there is no separate username or password field, e.g. mongodb://user:pass@host:27017/db?replicaSet=rs0. Write-only; blank on edit keeps the stored value. Connect lists the databases. |
| Database | Yes | — | Pick from the discovered list or enter it manually. Changing it reloads collections. |
| Auth source | No | the database itself | Which database the credentials are defined against, e.g. admin. Only needed when the URI does not already embed it. |
| Replica set | No | — | Replica-set name, e.g. rs0. Only needed when the URI does not already embed it. |
| Read preference | No | primary | primary or secondaryPreferred. |
| Filter collections | No | all collections | Comma-separated db.collection entries. Load collections turns the field into a multi-select. |
| Schema sample size | No | 1000 | Documents sampled per collection for type inference. |
| Direct connection | No | off | Single-node development Mongo with no replica set. Never enable it in production. |
How it replicates
- Each collection is scanned
find().sort(_id, 1)in chunks, checkpointing the last key after every chunk. The_idindex makes this always correct. - The current
clusterTimeis captured before the first snapshot row and streaming starts strictly after it, so a crash mid-load never skips intervening writes. - Streaming resumes from an opaque resume token. If it expires (
ChangeStreamHistoryLost) Fabric raises and requires a re-snapshot rather than silently restarting from now.
Snapshot consistency
Gotchas
Watch out
- A standalone deployment is refused unless direct connection is checked — and change streams still will not work against a true standalone. Standalone CDC is unsupported.
- Missing
find,changeStream, orlistCollectionsis a hard refusal naming the actions. - An update-lookup miss (the document changed again between update and lookup) is skipped with a warning; deletes emit only the
_id. - Field values mixing two BSON types, plus embedded documents and arrays, land as JSON; explicit nulls do not force that fallback.
- Connection string, Database, Read preference, and Direct connection are read-only after creation.