误删或误修改恢复
use local
rs01:PRIMARY> db.oplog.rs.find({"ns" : "db1.person",op:"d"}).sort({$natural:-1})  #查看删除文档的时间及对应的_id
{ "ts" : Timestamp(1549954450, 1), "t" : NumberLong(3), "h" : NumberLong("-6681904515486104442"), "v" : 2, "op" : "d", "ns" : "db1.person", "ui" : UUID("d04b8c07-db43-4962-af2d-2deb4263ba2b"), "wall" : ISODate("2019-02-12T06:54:10.392Z"), "o" : { "_id" : ObjectId("5c62673fc59489878ea72243") } }
{ "ts" : Timestamp(1549943355, 1), "t" : NumberLong(3), "h" : NumberLong("7844908950210772158"), "v" : 2, "op" : "d", "ns" : "db1.person", "ui" : UUID("d04b8c07-db43-4962-af2d-2deb4263ba2b"), "wall" : ISODate("2019-02-12T03:49:15.350Z"), "o" : { "_id" : ObjectId("5c5a747ceff4dc53d3d1507d") } }
{ "ts" : Timestamp(1549429454, 1), "t" : NumberLong(1), "h" : NumberLong("-5357780845893320295"), "v" : 2, "op" : "d", "ns" : "db1.person", "ui" : UUID("d04b8c07-db43-4962-af2d-2deb4263ba2b"), "wall" : ISODate("2019-02-06T05:04:14.275Z"), "o" : { "_id" : ObjectId("5c5a6ab1eff4dc53d3d15077") } }

rs01:PRIMARY> db.oplog.rs.find({"ns" : "db1.person",op:{$in: ["i","u"]},"o._id" : ObjectId("5c62673fc59489878ea72243")}).sort({$natural:-1}).limit(1) #查找对应_id的最后一条插入或更新的记录
{ "ts" : Timestamp(1549952831, 1), "t" : NumberLong(3), "h" : NumberLong("-9033442519675810114"), "v" : 2, "op" : "i", "ns" : "db1.person", "ui" : UUID("d04b8c07-db43-4962-af2d-2deb4263ba2b"), "wall" : ISODate("2019-02-12T06:27:11.564Z"), "o" : { "_id" : ObjectId("5c62673fc59489878ea72243"), "name" : "f", "age" : 26, "sex" : "woman" } }

rs01:PRIMARY> use db1
switched to db db1
rs01:PRIMARY> db.person.insert( { "_id" : ObjectId("5c62673fc59489878ea72243"), "name" : "f", "age" : 26, "sex" : "woman" })
WriteResult({ "nInserted" : 1 })

rs01:PRIMARY> db.person.find({name:"f"});
{ "_id" : ObjectId("5c62673fc59489878ea72243"), "name" : "f", "age" : 26, "sex" : "woman" }

---------------------------------------
恢复被删的集合：
a. 需要一份被删除前的全量备份
/usr/local/mongodb/bin/mongodump --host=10.11.12.140 --port=7002 --authenticationDatabase=admin --username=root --password=root --oplog --gzip --out=/data/backup/20190212/rs01-full
b. 被删除以后的oplog
/usr/local/mongodb/bin/mongodump --host=10.11.12.140 --port=7002 --authenticationDatabase=admin --username=root --password=root --db=local --collection=oplog.rs --out=/data/backup/20190212/
mkdir /data/backup/20190212/rs01-inc
mv /data/backup/20190212/local/oplog.rs.bson /data/backup/20190212/rs01-inc/oplog.bson
c. 新建一个单节点的副本集并完成初始化（不用开启认证，不用创建账号, 完成initiate即可）
导入全量 /usr/local/mongodb/bin/mongorestore --port=7004 --authenticationDatabase=admin --username=root --password=root --oplogReplay --gzip /data/backup/20190212/rs01-full
查看被删集合的timestamp /usr/local/mongodb/bin/bsondump rs01-inc-20190212-171600/oplog.bson |grep '"drop":'
导入增量 /usr/local/mongodb/bin/mongorestore --port=7004 --oplogReplay --oplogLimit="1549962951:1" /data/backup/20190212/rs01-inc-20190212-171600/
d. 把删除的集合从临时副本集导出再导回原库
/usr/local/mongodb/bin/mongodump --port=7004 --db=db1 --collection=t6 --out=/data/backup/db1 #从临时副本集导出
/usr/local/mongodb/bin/mongorestore --port=7001 --authenticationDatabase=admin --username=root --password=root /data/backup/db1/ #导入原库