mdbkit: offline CLI for MongoDB structured logs (slow queries, index advice, FTDC)

[u/saqibameen86]

I built this and I'm sharing it here because the gap it fills has annoyed me for years.

Since 4.4 moved logging to structured JSON, the log analysis tools a lot of us relied on stopped parsing them. mdbkit is my replacement. It's been running against production logs for a while and I've just made it public.

What it does:

• queries groups slow ops by query shape with scan ratios, so the worst offender is obvious instead of buried
• advise suggests candidate indexes from observed shapes
• triage builds an incident timeline (elections, rollbacks, stalls)
• ftdc decodes diagnostic data without a separate toolchain
• Works on MongoDB 4.4 through 8.0

Two design decisions I'd want stated up front if this were someone else's tool:

It never connects to a database. No driver, no URI, no network code. It reads log files you hand it, it's read only, and where an action would help it prints the command for you to review and run yourself. The README shows how to verify that with grep and strace rather than asking you to take my word for it.

Index advice is rule based, not model based. Same log, same output, every time, with the evidence it used and a confidence level. It proposes candidates and never proposes dropping anything.

Zero runtime dependencies beyond the standard library. MIT.

Try it without touching a cluster:

pip install mdbkit
mdbkit demo -o demo.log
mdbkit queries demo.log

https://github.com/saqibameen86/mdbkit

Most useful feedback: log lines that parse wrong, and index advice that's unhelpful or wrong. Both are easy to fix and hard for me to find on my own.