$redact (Redact)
Last updated: 2026-10-09
$redact (Redact)
$redact filters at field level using permission metadata stored in documents, with the system variables $$KEEP, $$PRUNE, and $$DESCEND. $$DESCEND descends into embedded documents, $$PRUNE drops the document and its subtree, and $$KEEP retains it. It is query-side filtering, not a security boundary.
| Category | Advanced & Diagnostic |
|---|---|
| MongoDB Version | 1.0+ |
| Example Language | mongosh (Shell) |
📝 Syntax
{ $redact: { $cond: { if: { $eq: [ "$level", "userLevel" ] }, then: "$$PRUNE", else: "$$DESCEND" } } }⚙️ Parameters
| condition expression | Expression evaluated at each nesting level, yielding $$KEEP, $$PRUNE, or $$DESCEND. |
|---|
Returns：Document stream pruned by access rules
▶ Example
Run the commands below in your local mongosh (requires a running mongod):
// $redact: keep only public content
db.employees.aggregate([
{ $redact: {
$cond: { if: { $eq: ['$access', 'public'] }, then: '$$KEEP', else: '$$DESCEND' }
} }
])Output：
// Non-public documents or fields are removed📌 Notes
- Only $$KEEP, $$PRUNE, and $$DESCEND are valid results
- Evaluation recurses through every nesting level
- Unlike $project, $redact filters recursively by level
🏷️ Related Tags
💡 Related Cases
More hands-on cases coming soon.
📚 Related Tutorials
❓ FAQ
QWhen is $$DESCEND used?
AWhen the current document passes but embedded documents still need checking; defer the decision downward.
QCan $redact replace an access-control system?
AIt filters at query time but is not a security boundary; clients can still query the collection directly.
QHow does $redact differ from $match?
A$match filters whole documents by top-level conditions; $redact decides per nesting level recursively.
