Kubernetes

In your watchlog-node-agent.yaml, locate the MongoDB env vars:

      - name: MONITOR_MONGODB
        value: "false"
      - name: MONGODB_HOST
        value: "127.0.0.1"
      - name: MONGODB_PORT
        value: "27017"
      - name: MONGODB_USERNAME
        value: ""
      - name: MONGODB_PASSWORD
        value: ""

Change MONITOR_MONGODB to "true" and update other values if needed:

-       value: "false"
+       value: "true"

Then apply the manifest:

kubectl apply -f watchlog-node-agent.yaml

Keep the password in a Secret

apiVersion: v1
kind: Secret
metadata:
  name: watchlog-mongodb
  namespace: watchlog
type: Opaque
stringData:
  password: "your_password"

      - name: MONGODB_PASSWORD
        valueFrom:
          secretKeyRef:
            name: watchlog-mongodb
            key: password

Pointing at a MongoDB Service

The node agent runs as a DaemonSet, so 127.0.0.1 only reaches a MongoDB running on that same node. To monitor a cluster-hosted MongoDB, use its Service DNS name:

      - name: MONGODB_HOST
        value: "mongodb.database.svc.cluster.local"
      - name: MONGODB_PORT
        value: "27017"

Which agent should monitor it?

A DaemonSet means every node's agent polls MongoDB — N agents collecting the same data. Watchlog identifies an instance by host:port, so they all write to the same integration and the data stays correct, but the polling is wasted.

Two ways to avoid it:

Preferred: run a single-replica Deployment of the agent dedicated to integrations, and keep the DaemonSet for host and container metrics only.
Or use a node selector so only one node's agent carries the MongoDB env vars.

Advanced options in Kubernetes

The env vars cover the connection. For advanced and slowQuery tuning — collection caps, throttle intervals, profiler reading — mount an integration.json through a ConfigMap instead:

apiVersion: v1
kind: ConfigMap
metadata:
  name: watchlog-integrations
  namespace: watchlog
data:
  integration.json: |
    [
      {
        "service": "mongodb",
        "monitor": true,
        "host": "mongodb.database.svc.cluster.local",
        "port": "27017",
        "username": "watchlog_monitor",
        "authDatabase": "admin",
        "advanced": {
          "storage": true,
          "indexes": true,
          "replication": true,
          "storageIntervalSeconds": 300
        },
        "slowQuery": { "enabled": false }
      }
    ]

          volumeMounts:
            - name: integrations
              mountPath: /app/app/config/integration.json
              subPath: integration.json
              readOnly: true
      volumes:
        - name: integrations
          configMap:
            name: watchlog-integrations

Warning

Do not put the password in the ConfigMap — a ConfigMap is readable by anything with get on the namespace. Keep it in the MONGODB_PASSWORD Secret env var.

Replica sets and operators

Point the agent at the replica set Service (or any single member). replSetGetStatus returns the whole set, so one entry covers every member's state, health and lag.

For MongoDB deployed by an operator, the credentials are usually in a generated Secret:

kubectl get secret <cluster>-admin-password -n database \
  -o go-template='{{.data.password | base64decode}}'

Create a dedicated watchlog_monitor user with clusterMonitor rather than reusing the admin account — see the integration overview for the exact role definition.