`mongorestore`¶

On this page

Mac OSX Sierra and Go 1.6 Incompatibility

Users running on Mac OSX Sierra require the 3.2.10 or newer version of mongorestore.

Synopsis¶

The mongorestore program writes data from a binary database dump created by mongodump to a MongoDB instance.

New in version 3.0.0: mongorestore also accepts data to restore via the standard input.

mongorestore can write data to either mongod or mongos instances.

Run mongorestore from the system command line, not the mongo shell.

For an overview of mongorestore usage, see Back Up and Restore with MongoDB Tools.

Behavior¶

Insert Only¶

mongorestore can create a new database or add data to an existing database. However, mongorestore performs inserts only and does not perform updates. That is, if restoring documents to an existing database and collection and existing documents have the same value _id field as the to-be-restored documents, mongorestore will not overwrite those documents.

Rebuild Indexes¶

mongorestore recreates indexes recorded by mongodump.

Version Compatibility¶

The data format used by mongodump from version 2.2 or later is incompatible with earlier versions of mongod. Do not use recent versions of mongodump to back up older data stores.

Exclude `system.profile` Collection¶

mongorestore does not restore the system.profile collection data; however, if the backup data includes system.profile collection data and the collection does not exist in the target database, mongorestore creates the collection but does not insert any data into the collection.

Required Access¶

To restore data to a MongoDB deployment that has access control enabled, the restore role provides access to restore any database if the backup data does not include system.profile collection data.

If the backup data includes system.profile collection data and the target database does not contain the system.profile collection, mongorestore attempts to create the collection even though the program does not actually restore system.profile documents. As such, the user requires additional privileges to perform createCollection and convertToCapped actions on the system.profile collection for a database.

If running mongorestore with --oplogReplay, the restore role is insufficient to replay the oplog. To replay the oplog, create a user-defined role that has anyAction on anyResource and grant only to users who must run mongorestore with --oplogReplay.

Options¶

Changed in version 3.0.0: mongorestore removed the --filter, --dbpath, and the --noobjcheck options.

mongorestore¶

mongorestore¶

--help¶: Returns information on the options and use of mongorestore.

--verbose, -v¶: Increases the amount of internal reporting returned on standard output or in log files. Increase the verbosity with the -v form by including the option multiple times, (e.g. -vvvvv.)

--quiet¶

Runs mongorestore in a quiet mode that attempts to limit the amount of output.

This option suppresses:

output from database commands
replication activity
connection accepted events
connection closed events

--version¶: Returns the mongorestore release number.

--host <hostname><:port>, -h <hostname><:port>¶

Default: localhost:27017

Specifies a resolvable hostname for the mongod to which to connect. By default, the mongorestore attempts to connect to a MongoDB instance running on the localhost on port number 27017.

To connect to a replica set, specify the replSetName and a seed list of set members, as in the following:

<replSetName>/<hostname1><:port>,<hostname2><:port>,<...>

You can always connect directly to a single MongoDB instance by specifying the host and port number directly.

Changed in version 3.0.0: If you use IPv6 and use the <address>:<port> format, you must enclose the portion of an address and port combination in brackets (e.g. [<address>]).

--port <port>¶

Default: 27017

Specifies the TCP port on which the MongoDB instance listens for client connections.

--ssl¶: New in version 2.6.

Enables connection to a mongod or mongos that has TLS/SSL support enabled.

Changed in version 3.0: Most MongoDB distributions include support for TLS/SSL. See Configure mongod and mongos for TLS/SSL and TLS/SSL Configuration for Clients for more information about TLS/SSL and MongoDB.

Changed in version 3.4: If --sslCAFile is not specified when connecting to an TLS/SSL-enabled server, the system-wide CA certificate store will be used.

--sslCAFile <filename>¶: New in version 2.6.

Specifies the .pem file that contains the root certificate chain from the Certificate Authority. Specify the file name of the .pem file using relative or absolute paths.

Changed in version 3.0: Most MongoDB distributions include support for TLS/SSL. See Configure mongod and mongos for TLS/SSL and TLS/SSL Configuration for Clients for more information about TLS/SSL and MongoDB.

Changed in version 3.4: If --sslCAFile is not specified when connecting to an TLS/SSL-enabled server, the system-wide CA certificate store will be used.

Warning

Version 3.2 and earlier: For SSL connections (--ssl) to mongod and mongos, if the mongorestore runs without the --sslCAFile, mongorestore will not attempt to validate the server certificates. This creates a vulnerability to expired mongod and mongos certificates as well as to foreign processes posing as valid mongod or mongos instances. Ensure that you always specify the CA file to validate the server certificates in cases where intrusion is a possibility.

--sslPEMKeyFile <filename>¶

New in version 2.6.

Specifies the .pem file that contains both the TLS/SSL certificate and key. Specify the file name of the .pem file using relative or absolute paths.

This option is required when using the --ssl option to connect to a mongod or mongos that has CAFile enabled without allowConnectionsWithoutCertificates.

Changed in version 3.0: Most MongoDB distributions include support for TLS/SSL. See Configure mongod and mongos for TLS/SSL and TLS/SSL Configuration for Clients for more information about TLS/SSL and MongoDB.

Changed in version 3.4: If --sslCAFile is not specified when connecting to an TLS/SSL-enabled server, the system-wide CA certificate store will be used.

--sslPEMKeyPassword <value>¶

New in version 2.6.

Specifies the password to de-crypt the certificate-key file (i.e. --sslPEMKeyFile). Use the --sslPEMKeyPassword option only if the certificate-key file is encrypted. In all cases, the mongorestore will redact the password from all logging and reporting output.

If the private key in the PEM file is encrypted and you do not specify the --sslPEMKeyPassword option, the mongorestore will prompt for a passphrase. See SSL Certificate Passphrase.

Changed in version 3.0: Most MongoDB distributions include support for TLS/SSL. See Configure mongod and mongos for TLS/SSL and TLS/SSL Configuration for Clients for more information about TLS/SSL and MongoDB.

Changed in version 3.4: If --sslCAFile is not specified when connecting to an TLS/SSL-enabled server, the system-wide CA certificate store will be used.

--sslCRLFile <filename>¶: New in version 2.6.

Specifies the .pem file that contains the Certificate Revocation List. Specify the file name of the .pem file using relative or absolute paths.

Changed in version 3.0: Most MongoDB distributions include support for TLS/SSL. See Configure mongod and mongos for TLS/SSL and TLS/SSL Configuration for Clients for more information about TLS/SSL and MongoDB.

Changed in version 3.4: If --sslCAFile is not specified when connecting to an TLS/SSL-enabled server, the system-wide CA certificate store will be used.

--sslAllowInvalidCertificates¶: New in version 2.6.

Bypasses the validation checks for server certificates and allows the use of invalid certificates. When using the allowInvalidCertificates setting, MongoDB logs as a warning the use of the invalid certificate.

Changed in version 3.0: Most MongoDB distributions include support for TLS/SSL. See Configure mongod and mongos for TLS/SSL and TLS/SSL Configuration for Clients for more information about TLS/SSL and MongoDB.

Changed in version 3.4: If --sslCAFile is not specified when connecting to an TLS/SSL-enabled server, the system-wide CA certificate store will be used.

--sslAllowInvalidHostnames¶: New in version 3.0.

Disables the validation of the hostnames in TLS/SSL certificates. Allows mongorestore to connect to MongoDB instances even if the hostname in their certificates do not match the specified hostname.

Changed in version 3.0: Most MongoDB distributions include support for TLS/SSL. See Configure mongod and mongos for TLS/SSL and TLS/SSL Configuration for Clients for more information about TLS/SSL and MongoDB.

Changed in version 3.4: If --sslCAFile is not specified when connecting to an TLS/SSL-enabled server, the system-wide CA certificate store will be used.

--sslFIPSMode¶: New in version 2.6.

Directs the mongorestore to use the FIPS mode of the installed OpenSSL library. Your system must have a FIPS compliant OpenSSL library to use the --sslFIPSMode option.

Note

FIPS-compatible SSL is available only in MongoDB Enterprise. See Configure MongoDB for FIPS for more information.

--username <username>, -u <username>¶: Specifies a username with which to authenticate to a MongoDB database that uses authentication. Use in conjunction with the --password and --authenticationDatabase options.

--password <password>, -p <password>¶: Specifies a password with which to authenticate to a MongoDB database that uses authentication. Use in conjunction with the --username and --authenticationDatabase options.

Changed in version 3.0.0: If you do not specify an argument for --password, mongorestore returns an error.

Changed in version 3.0.2: If you wish mongorestore to prompt the user for the password, pass the --username option without --password or specify an empty string as the --password value, as in --password "" .

--authenticationDatabase <dbname>¶: Specifies the database in which the user is created. See Authentication Database.

--authenticationMechanism <name>¶

Default: SCRAM-SHA-1

Changed in version 2.6: Added support for the PLAIN and MONGODB-X509 authentication mechanisms.

Changed in version 3.0: Added support for the SCRAM-SHA-1 authentication mechanism. Changed default mechanism to SCRAM-SHA-1.

Specifies the authentication mechanism the mongorestore instance uses to authenticate to the mongod or mongos.

Value	Description
SCRAM-SHA-1	RFC 5802 standard Salted Challenge Response Authentication Mechanism using the SHA1 hash function.
MONGODB-CR	MongoDB challenge/response authentication.
MONGODB-X509	MongoDB TLS/SSL certificate authentication.
GSSAPI (Kerberos)	External authentication using Kerberos. This mechanism is available only in MongoDB Enterprise.
PLAIN (LDAP SASL)	External authentication using LDAP. You can also use `PLAIN` for authenticating in-database users. `PLAIN` transmits passwords in plain text. This mechanism is available only in MongoDB Enterprise.

--gssapiServiceName¶

New in version 2.6.

Specify the name of the service using GSSAPI/Kerberos. Only required if the service does not use the default name of mongodb.

This option is available only in MongoDB Enterprise.

--gssapiHostName¶

New in version 2.6.

Specify the hostname of a service using GSSAPI/Kerberos. Only required if the hostname of a machine does not match the hostname resolved by DNS.

This option is available only in MongoDB Enterprise.

--db <database>, -d <database>¶

Specifies a database for mongorestore to restore data into. If the database does not exist, mongorestore creates the database. If you do not specify a <db>, mongorestore creates new databases that correspond to the databases where data originated and data may be overwritten. Use this option to restore data into a MongoDB instance that already has data.

--db does not control which BSON files mongorestore restores. You must use the mongorestore path option to limit that restored data.

--collection <collection>, -c <collection>¶: Specifies a single collection for mongorestore to restore. If you do not specify --collection, mongorestore takes the collection name from the input filename. If the input file has an extension, MongoDB omits the extension of the file from the collection name.

--nsExclude <namespace pattern>¶

New in version 3.4.

Excludes the specified namespaces from the restore operation.

--nsExclude accepts a namespace pattern as its argument. The namespace pattern permits --nsExclude to refer to any namespace that matches the specified pattern. mongorestore matches the smallest valid occurence of the namespace pattern.

Use asterisks (*) as wild cards. Escape all literal asterisks and backslashes with a backslash. Restore Collections Using Wild Cards provides an example of using asterisks as wild cards.

--nsInclude <namespace pattern>¶

New in version 3.4.

Includes only the specified namespaces in the restore operation. By enabling you to specify multiple collections to restore, --nsInclude offers a superset of the functionality of the --collection option.

--nsInclude accepts a namespace pattern as its argument. The namespace pattern permits --nsInclude to refer to any namespace that matches the specified pattern. mongorestore matches the smallest valid occurence of the namespace pattern.

Use asterisks (*) as wild cards. Escape all literal asterisks and backslashes with a backslash. Restore Collections Using Wild Cards provides an example of using asterisks as wild cards.

--nsFrom <namespace pattern>¶

New in version 3.4.

Use with --nsTo to rename a namespace during the restore operation. --nsFrom specifies the collection in the dump file, while --nsTo specifies the name that should be used in the restored database.

--nsFrom accepts a namespace pattern as its argument. The namespace pattern permits --nsFrom to refer to any namespace that matches the specified pattern. mongorestore matches the smallest valid occurence of the namespace pattern.

For simple replacements, use asterisks (*) as wild cards. Escape all literal asterisks and backslashes with a backslash. Replacements correspond linearly to matches: each asterisk in --nsFrom must correspond to an asterisk in --nsTo, and the first asterisk in --nsFrom matches the first asterisk in nsTo.

For more complex replacements, use dollar signs to delimit a “wild card” variable to use in the replacement. Change Collections’ Namespaces during Restore provides an example of complex replacements with dollar sign-delimited wild cards.

Unlike replacements with asterisks, replacements with dollar sign-delimited wild cards do not need to be linear.

--nsTo <namespace pattern>¶

New in version 3.4.

Use with --nsFrom to rename a namespace during the restore operation. --nsTo specifies the new collection name to use in the restored database, while --nsFrom specifies the name in the dump file.

--nsTo accepts a namespace pattern as its argument. The namespace pattern permits --nsTo to refer to any namespace that matches the specified pattern. mongorestore matches the smallest valid occurence of the namespace pattern.

For simple replacements, use asterisks (*) as wild cards. Escape all literal asterisks and backslashes with a backslash. Replacements correspond linearly to matches: each asterisk in --nsFrom must correspond to an asterisk in --nsTo, and the first asterisk in --nsFrom matches the first asterisk in nsTo.

For more complex replacements, use dollar signs to delimit a “wild card” variable to use in the replacement. Change Collections’ Namespaces during Restore provides an example of complex replacements with dollar sign-delimited wild cards.

Unlike replacements with asterisks, replacements with dollar sign-delimited wild cards do not need to be linear.

--objcheck¶: Forces mongorestore to validate all requests from clients upon receipt to ensure that clients never insert invalid documents into the database. For objects with a high degree of sub-document nesting, --objcheck can have a small impact on performance.

--drop¶

Before restoring the collections from the dumped backup, drops the collections from the target database. --drop does not drop collections that are not in the backup.

When the restore includes the admin database, mongorestore with --drop removes all user credentials and replaces them with the users defined in the dump file. Therefore, in systems with authorization enabled, mongorestore must be able to authenticate to an existing user and to a user defined in the dump file. If mongorestore can’t authenticate to a user defined in the dump file, the restoration process will fail, leaving an empty database.

--dryRun¶: New in version 3.4.

Runs mongorestore without actually importing any data, returning the mongorestore summary information. Use with --verbose to produce more detailed summary information.

--oplogReplay¶

After restoring the database dump, replays the oplog entries from the oplog.bson file located in the top level of the dump directory. When used in conjunction with mongodump --oplog, mongorestore --oplogReplay restores the database to the point-in-time backup captured with the mongodump --oplog command. For an example of --oplogReplay, see Restore Point in Time Oplog Backup.

mongorestore --oplogReplay replays any valid oplog.bson file found in the top level of the dump directory. That is, if you have a bson file that contains valid oplog entries, you can name the file oplog.bson and move it to the top level of the dump directory for mongorestore --oplogReplay to replay.

Examples¶

Restore a Collection¶

Consider the following example:

mongorestore --collection people --db accounts dump/

Here, mongorestore reads the database dump in the dump/ sub-directory of the current directory, and restores only the documents in the collection named people from the database named accounts. mongorestore restores data to the instance running on the localhost interface on port 27017.

New in version 3.4.

You may alternatively use --nsInclude to specify the canonical name of the collection that you wish to restore rather than --collection. --nsInclude enables you to specify the namespace of one or more collections that you wish to include in the restore operation. The following example restores the people collection from the accounts database in the dump/ sub-directory of the current directory:

mongorestore --nsInclude accounts.people dump/

Restore Collections Using Wild Cards¶

New in version 3.4.

--nsInclude and --nsExclude support specifying the namespaces you wish to include or exclude from a restore operation using asterisks as wild cards.

The following example restores the documents in the dump/ sub-directory of the current directory that match the specified namespace pattern. The --nsInclude statement specifies to only restore documents in the transactions database while --nsExclude instructs mongorestore to exclude collections whose names end with _dev. mongorestore restores data to the mongod instance running on the localhost interface on port 27017.

mongorestore --nsInclude 'transactions.*' --nsExclude 'transactions.*_dev' dump/

Change Collections’ Namespaces during Restore¶

New in version 3.4.

MongoDB 3.4 added the --nsFrom and --nsTo options, which enable you to change the namespace of a collection that you are restoring. --nsFrom and --nsTo support using asterisks as wild cards and support using dollar signs to delimit “wild card” variables to use in the replacement.

Consider a database data that you have exported to a dump/ directory using mongodump. The data database contains the following collections:

sales_customer1
sales_customer2
sales_customer3
users_customer1
users_customer2
users_customer3

Using --nsFrom and --nsTo, you can restore the data into different namespaces. The following operation

restores the sales_<customerName> collections in the data database to sales collections in the <customerName> database, and
restores the users_<customerName> collections to users collections in the <customerName> database.

mongorestore --nsInclude 'data.*' --nsFrom 'data.$prefix$_$customer$' --nsTo '$customer$.$prefix$'

Restore with Access Control¶

In the following example, mongorestore restores a database dump located at /opt/backup/mongodump-2011-10-24, to a database running on port 37017 on the host mongodb1.example.net. The mongorestore command authenticates to the MongoDB instance using the username user and the password pass, as follows:

mongorestore --host mongodb1.example.net --port 37017 --username user --password "pass" /opt/backup/mongodump-2011-10-24

Restore a Collection from Standard Input¶

You can also pipe data directly into to mongorestore through standard input, as in the following example:

zcat /opt/backup/mongodump-2014-12-03/accounts.people.bson.gz | mongorestore --collection people --db accounts -

Restore a Database from an Archive File¶

New in version 3.2.

To restore from an archive file, run restore with the new --archive option and the archive filename. For example, the following operation restores the test database from the file test.20150715.archive.

mongorestore --archive=test.20150715.archive --db test

Restore a Database from Standard Input¶

New in version 3.2.

To restore from the standard input, run mongorestore with the archive option but omit the filename. For example:

mongodump --archive --db test --port 27017 | mongorestore --archive --port 27018

Restore from Compressed Data¶

New in version 3.2: With the --gzip option, mongorestore can restore from compressed files or data stream created by mongodump.

To restore from a dump directory that contains compressed files, run mongorestore with the new --gzip option. For example, the following operation restores the test database from the compressed files located in the default dump directory:

mongorestore --gzip --db test

To restore from a compressed archive file, run mongorestore with the --gzip option in conjunction with the new --archive option. For example, the following operation restores the test database from the archive file test.20150715.gz.

mongorestore --gzip --archive=test.20150715.gz --db test

Additional Resources¶

← mongodump bsondump →

mongorestore¶

Synopsis¶

Behavior¶

Insert Only¶

Rebuild Indexes¶

Version Compatibility¶

Exclude system.profile Collection¶

Required Access¶

Options¶

Examples¶

Restore a Collection¶

Restore Collections Using Wild Cards¶

Change Collections’ Namespaces during Restore¶

Restore with Access Control¶

Restore a Collection from Standard Input¶

Restore a Database from an Archive File¶

Restore a Database from Standard Input¶

Restore from Compressed Data¶

Additional Resources¶

`mongorestore`¶

Exclude `system.profile` Collection¶