use mongoexport --query option

mongoexport --host mongodb1.test.asia --port 27017 --db traffic_l3 --collection ip_traffic_spe --query '{"$and": [{"time": {"$lte": 1460361920, "$gte": 1460358324}}, {"vip": {"$in": ["207.192.186.59"]}}]}' --out ip_traffic_spe_minute2.json

mongoexport --host mongodb1.test.asia --port 27017 --db traffic_l3 --collection ip_traffic_spe_10minute --query '{"time": {$lte: 1459468800, $gte: 1456790400}}' --out test.json

2016-04-06T11:48:49.056+0800 connected to: mongodb1.nexusguard.asia:27017
2016-04-06T11:48:50.056+0800 traffic_l3.ip_traffic_spe_10minute 0
2016-04-06T11:48:51.056+0800 traffic_l3.ip_traffic_spe_10minute 0
2016-04-06T11:48:52.056+0800 traffic_l3.ip_traffic_spe_10minute 0
2016-04-06T11:48:53.056+0800 traffic_l3.ip_traffic_spe_10minute 0
2016-04-06T11:48:54.056+0800 traffic_l3.ip_traffic_spe_10minute 0
2016-04-06T11:48:55.056+0800 traffic_l3.ip_traffic_spe_10minute 0
2016-04-06T11:48:56.056+0800 traffic_l3.ip_traffic_spe_10minute 0
2016-04-06T11:48:57.056+0800 traffic_l3.ip_traffic_spe_10minute 0
2016-04-06T11:48:58.056+0800 traffic_l3.ip_traffic_spe_10minute 0
2016-04-06T11:48:59.056+0800 traffic_l3.ip_traffic_spe_10minute 8000
2016-04-06T11:49:00.056+0800 traffic_l3.ip_traffic_spe_10minute 8000
2016-04-06T11:49:01.056+0800 traffic_l3.ip_traffic_spe_10minute 16000
2016-04-06T11:49:02.056+0800 traffic_l3.ip_traffic_spe_10minute 16000
2016-04-06T11:49:03.056+0800 traffic_l3.ip_traffic_spe_10minute 16000
2016-04-06T11:49:04.056+0800 traffic_l3.ip_traffic_spe_10minute 24000