Projection: Selecting Fields in Query Results

Projection controls which fields MongoDB returns from matching documents. It can reduce response size and prevent unnecessary fields from being exposed to application code.

Include specific fields

db.users.find(
  { active: true },
  { name: 1, email: 1 }
);

The query returns matching documents with name, email, and _id by default.

Exclude the identifier

db.users.find(
  { active: true },
  { name: 1, email: 1, _id: 0 }
);

The _id field is included by default unless explicitly excluded.

Exclude a field

db.users.find(
  {},
  { passwordHash: 0 }
);

This excludes passwordHash while retaining other fields.

Inclusion and exclusion rules

Ordinarily, you cannot mix inclusion and exclusion projections in the same projection, apart from excluding _id in an inclusion projection.

For example, this is a valid inclusion projection:

{ name: 1, email: 1, _id: 0 }

This is generally invalid as an ordinary find projection:

{ name: 1, passwordHash: 0 }

Nested-field projection

db.users.find(
  {},
  { name: 1, "address.city": 1, _id: 0 }
);

This includes the name and the nested city field.

Array projection operators

MongoDB offers specialized projection mechanisms for arrays, including positional projection and $slice, with distinct semantics.

For example, $slice can return only a portion of an array in the result:

db.posts.find(
  {},
  { title: 1, comments: { $slice: 5 } }
);

This returns up to five array elements in the projected comments field. It does not limit how many documents the query returns.

Projection is not authorization

Projection can help reduce data returned by a query, but sensitive fields should also be protected through authorization and careful API response design. Do not assume that selecting fields at the database layer alone implements every application security requirement.

Include and exclude fields

db.projectionDemo.insertOne({
  name: "Arun",
  email: "arun@example.com",
  passwordHash: "example-hash",
  address: {
    city: "Chennai",
    country: "India"
  },
  skills: ["Node.js", "MongoDB", "React"]
});

// Include selected fields and exclude _id.
db.projectionDemo.find(
  {},
  { name: 1, email: 1, _id: 0 }
);

// Return all fields except passwordHash.
db.projectionDemo.find(
  {},
  { passwordHash: 0 }
);

// Include a nested field and a subset of an array.
db.projectionDemo.find(
  {},
  { name: 1, "address.city": 1, skills: { $slice: 2 }, _id: 0 }
);

💡 The examples demonstrate inclusion projection, exclusion projection, nested-field projection, and array slicing. The inclusion and exclusion modes should not be mixed arbitrarily. Projection controls returned fields, not the number of documents returned.

Key Takeaways

Projection selects which fields are returned.
The _id field is included by default unless excluded.
Inclusion and exclusion projections generally cannot be mixed, apart from excluding _id.
Nested fields can be projected using dot notation.
Projection reduces returned data but is not a complete authorization strategy.

Knowledge Check

What does `{ name: 1, email: 1, _id: 0 }` do in a find projection?