The “one blank record” in the first run is expected - the tap will open a change stream, record its “resume token”, and then close the change stream and exit. That resume token is saved as the replication key value. On the next run of the tap in log-based replication mode, it will output any events since that first resume token.