PII Masking & Query Hash Anonymization

Parent: Diagnostic Tool Design · Published reference · snapshot 2026-10-15 · viability 3.00 / 5 (skip)

Depth-first rabbithole dossier for PII Masking & Query Hash Anonymization; source-anchored research pack.

These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.

Definitions

[low] The `internalQueryStatsSampleRate` parameter is a floating-point number between 0.0 and 1.0 representing the fraction of queries for which stats are recorded. Sources: https://raw.githubusercontent.com/mongodb/mongo/master/src/mongo/db/query/query_stats/README.md [source]
[low] Query stats are not collected on explain-only paths, but aggregate explains run through the same path as non-explains and thus have query stats collected. Sources: https://raw.githubusercontent.com/mongodb/mongo/master/src/mongo/db/query/query_stats/README.md [source]

Structure and components

[low] Instrumentations should not capture `db.query.parameter.<key>` by default since values may contain PII, but parameterized query text itself should be collected by default. Sources: https://opentelemetry.io/docs/specs/semconv/database/database-spans/ [source]
[low] The `db.query.summary` attribute should have low cardinality, contain no dynamic or sensitive data, and be truncated to 255 characters if parsed from the query. Sources: https://opentelemetry.io/docs/specs/semconv/database/database-spans/ [source]

How it works

[low] Metrics recorded only when plan enumeration runs are reported alongside the `numPlanEnumerations` counter, which serves as the denominator. Sources: https://raw.githubusercontent.com/mongodb/mongo/master/src/mongo/db/query/query_stats/README.md [source]
[low] Collection and operation names should not be extracted from `db.query.text` when the database system supports multiple collections or operations in non-batch operations. Sources: https://opentelemetry.io/docs/specs/semconv/database/database-spans/ [source]

Measurements and reference values

[low] The maximum query stats store size defaults to 1% of the machine's total memory and can be specified as a string like "4MB" or "1%". Sources: https://raw.githubusercontent.com/mongodb/mongo/master/src/mongo/db/query/query_stats/README.md [source]

Problems, failure modes and limitations

[low] The `internalQueryStatsRateLimit` parameter is an integer imposing a maximum number of recordings per second, defaulting to 0 (disabled) or -1 for no limit. Sources: https://raw.githubusercontent.com/mongodb/mongo/master/src/mongo/db/query/query_stats/README.md [source]
[low] The query stats store is a partitioned LRU cache structure where least recently used entries are evicted if a partition exceeds its size limit. Sources: https://raw.githubusercontent.com/mongodb/mongo/master/src/mongo/db/query/query_stats/README.md [source]
[low] Query stats collection for write commands is controlled by a parameter set to 0 or 1, which is only effective if query stats are already enabled via rate limit or sample rate settings. Sources: https://raw.githubusercontent.com/mongodb/mongo/master/src/mongo/db/query/query_stats/README.md [source]

Facts and statements

[high] The only currently supported `algorithm` value for PII masking in query stats is `hmac-sha-256`. Sources: https://www.mongodb.com/docs/manual/reference/operator/aggregation/queryStats.md, https://raw.githubusercontent.com/mongodb/mongo/master/src/mongo/db/query/query_stats/README.md [source]
[low] A one-way tokenized object applies an HMAC hashing function to sensitive elements, ensuring the transformation is never meant to be undone. Sources: https://raw.githubusercontent.com/mongodb/mongo/master/src/mongo/db/query/query_stats/README.md [source]
[low] MongoDB retains anonymized query data collected via `$queryStats` for four years to help improve MongoDB products. Sources: https://www.mongodb.com/docs/manual/reference/operator/aggregation/queryStats.md [source]
[low] If both `internalQueryStatsSampleRate` and `internalQueryStatsRateLimit` are set to non-zero values, the sampling-based policy takes precedence over the window-based rate limiter. Sources: https://raw.githubusercontent.com/mongodb/mongo/master/src/mongo/db/query/query_stats/README.md [source]
[low] For change stream collections, each `getMore` operation is treated as its own query, with query stats collected and updated for each one. Sources: https://raw.githubusercontent.com/mongodb/mongo/master/src/mongo/db/query/query_stats/README.md [source]
[low] Update and delete operations register and record metrics per statement, while insert operations register and record metrics per command. Sources: https://raw.githubusercontent.com/mongodb/mongo/master/src/mongo/db/query/query_stats/README.md [source]
[low] In sharded deployments, the router aggregates metrics received from shards into its own query stats store. Sources: https://raw.githubusercontent.com/mongodb/mongo/master/src/mongo/db/query/query_stats/README.md [source]
[low] Metrics for join optimization are always collected locally on sharded collections and are never rolled up from shards. Sources: https://raw.githubusercontent.com/mongodb/mongo/master/src/mongo/db/query/query_stats/README.md [source]
[high] The `cpuNanos` field, which specifies total CPU time in nanoseconds, is only available on Linux systems and will not be returned on other platforms. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/manual/reference/log-messages.md, https://raw.githubusercontent.com/mongodb/mongo/master/src/mongo/db/query/query_stats/README.md [source]
[low] The `http.url` tag includes the full URL with query string, and Datadog parses and redacts suspicious-looking values in the query string by default. Sources: https://docs.datadoghq.com/tracing/configure_data_security/ [source]
[low] Semantic conventions state that `db.query.text` should be collected by default only if sanitization excludes sensitive information, replacing literals with a placeholder value like "?". Sources: https://opentelemetry.io/docs/specs/semconv/database/database-spans/ [source]
[low] Parameterized query text should not be sanitized, while non-parameterized query text should not be collected by default unless sanitization excludes sensitive data. Sources: https://opentelemetry.io/docs/specs/semconv/database/database-spans/ [source]
[low] Instrumentations should capture operation and target values without case normalization, and these values should match those used in `db.query.summary`. Sources: https://opentelemetry.io/docs/specs/semconv/database/database-spans/ [source]
[low] For batch operations, query text and summary should be handled based on whether individual operations share the same text or summary, using separators or prefixes like "BATCH". Sources: https://opentelemetry.io/docs/specs/semconv/database/database-spans/ [source]
[low] Hashing transforms data like email addresses or phone numbers into consistent hexadecimal numbers, but hashes are not anonymous and can still be used to identify users. Sources: https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/07/no-hashing-still-doesnt-make-your-data-anonymous [source]
[low] The `DD_APM_OBFUSCATION_HTTP_REMOVE_QUERY_STRING` environment variable obfuscates query strings in URLs if true, and `DD_APM_OBFUSCATION_HTTP_REMOVE_PATHS_WITH_DIGITS` replaces path segments containing digits with "?". Sources: https://docs.datadoghq.com/tracing/configure_data_security/ [source]
[low] The regular expression for query string redaction can be modified via the `DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP` environment variable, and query string collection can be disabled by setting `DD_HTTP_SERVER_TAG_QUERY_STRING` to false. Sources: https://docs.datadoghq.com/tracing/configure_data_security/ [source]
[low] Metrics collection for query stats occurs in the hot path of query execution and must add negligible CPU and memory cost. Sources: https://raw.githubusercontent.com/mongodb/mongo/master/src/mongo/db/query/query_stats/README.md [source]
[low] Aggregation semantics for query stats metrics use addition for totals, maximum for maximums, OR for boolean flags, and AND for conjunctions. Sources: https://raw.githubusercontent.com/mongodb/mongo/master/src/mongo/db/query/query_stats/README.md [source]

Related concepts

Query — is a part of PII Masking & Query Hash Anonymization
PII — is a part of PII Masking & Query Hash Anonymization
Masking — is a part of PII Masking & Query Hash Anonymization
Hash — is a part of PII Masking & Query Hash Anonymization

Children

No children recorded.

← the whole tree · 3D view· how to read this page