Connect

kafka

Deprecated in 4.68.0

This component is deprecated and will be removed in the next major version release. Please consider moving onto the unified redpanda input and redpanda output components.

The kafka output writes a batch of messages to Kafka brokers and waits for acknowledgement before propagating any acknowledgements back to the input.

Common
Advanced

output:
  label: ""
  kafka:
    addresses: [] # No default (required)
    topic: "" # No default (required)
    target_version: "" # No default (optional)
    key: ""
    partitioner: fnv1a_hash
    compression: none
    static_headers: {} # No default (optional)
    metadata:
      exclude_prefixes: []
    max_in_flight: 64
    batching:
      count: 0
      byte_size: 0
      period: ""
      check: ""

output:
  label: ""
  kafka:
    addresses: [] # No default (required)
    tls:
      enabled: false
      skip_cert_verify: false
      enable_renegotiation: false
      root_cas: ""
      root_cas_file: ""
      client_certs: []
    sasl:
      mechanism: none
      user: ""
      password: ""
      access_token: ""
      token_cache: ""
      token_key: ""
    topic: "" # No default (required)
    client_id: benthos
    target_version: "" # No default (optional)
    rack_id: ""
    key: ""
    partitioner: fnv1a_hash
    partition: ""
    custom_topic_creation:
      enabled: false
      partitions: -1
      replication_factor: -1
    compression: none
    static_headers: {} # No default (optional)
    metadata:
      exclude_prefixes: []
    inject_tracing_map: "" # No default (optional)
    max_in_flight: 64
    idempotent_write: false
    ack_replicas: false
    max_msg_bytes: 1000000
    timeout: 5s
    retry_as_batch: false
    batching:
      count: 0
      byte_size: 0
      period: ""
      check: ""
      processors: [] # No default (optional)
    max_retries: 0
    backoff:
      initial_interval: 3s
      max_interval: 10s
      max_elapsed_time: 30s
    timestamp_ms: "" # No default (optional)

The configuration field ack_replicas determines whether Redpanda Connect waits for acknowledgement from all replicas or just a single broker.

Both the key and topic fields can be dynamically set using function interpolations described in Bloblang queries.

Metadata will be added to each message sent as headers (version 0.11+), but can be restricted using the field metadata.

Strict ordering and retries

When strict ordering is required for messages written to topic partitions it is important to ensure that both the field max_in_flight is set to 1 and that the field retry_as_batch is set to true.

You must also ensure that failed batches are never rerouted back to the same output. This can be done by setting the field max_retries to 0 and backoff.max_elapsed_time to empty, which will apply back pressure indefinitely until the batch is sent successfully.

However, this also means that manual intervention will eventually be required in cases where the batch cannot be sent due to configuration problems such as an incorrect max_msg_bytes estimate. A less strict but automated alternative would be to route failed batches to a dead letter queue using a fallback broker, but this would allow subsequent batches to be delivered in the meantime whilst those failed batches are dealt with.

Troubleshooting

If you’re seeing issues writing to or reading from Kafka with this component then it’s worth trying out the newer kafka_franz output.

I’m seeing logs that report Failed to connect to kafka: kafka: client has run out of available brokers to talk to (Is your cluster reachable?), but the brokers are definitely reachable.

Unfortunately this error message will appear for a wide range of connection problems even when the broker endpoint can be reached. Double check your authentication configuration and also ensure that you have enabled TLS if applicable.

Performance

This output benefits from sending multiple messages in flight in parallel for improved performance. You can tune the max number of in flight messages (or message batches) with the field max_in_flight.

This output benefits from sending messages as a batch for improved performance. Batches can be formed at both the input and output level. You can find out more in this doc.

Fields

`ack_replicas`

Ensure that messages have been copied across all replicas before acknowledging receipt.

Type: bool

Default: false

`addresses[]`

A list of broker addresses to connect to. List items that contain commas are expanded into multiple addresses.

Type: array<string>

# Examples:
addresses:
  - "localhost:9092"

# ---

addresses:
  - "localhost:9041,localhost:9042"

# ---

addresses:
  - "localhost:9041"
  - "localhost:9042"

`backoff`

The exponential backoff between attempts to resend messages that failed to send.

Type: object

`backoff.initial_interval`

The initial period to wait between retry attempts. The retry interval increases for each failed attempt, up to the max_interval value. This field accepts Go duration format strings such as 100ms, 1s, or 5s.

Type: string

Default: 3s

# Examples:
initial_interval: 50ms

# ---

initial_interval: 1s

`backoff.max_elapsed_time`

The maximum overall period of time to spend on retry attempts before the request is aborted. Setting this value to a zeroed duration (such as 0s) will result in unbounded retries.

Type: string

Default: 30s

# Examples:
max_elapsed_time: 1m

# ---

max_elapsed_time: 1h

`backoff.max_interval`

The maximum period to wait between retry attempts

Type: string

Default: 10s

# Examples:
max_interval: 5s

# ---

max_interval: 1m

`batching`

Configure a batching policy.

Type: object

# Examples:
batching:
  byte_size: 5000
  count: 0
  period: 1s

# ---

batching:
  count: 10
  period: 1s

# ---

batching:
  check: this.contains("END BATCH")
  count: 0
  period: 1m

`batching.byte_size`

The maximum total size (in bytes) that a batch can reach before it is flushed. When the combined size of all messages in the batch reaches or exceeds this limit, the batch is immediately sent to the next stage (such as a processor or output).

Set to 0 to disable size-based batching. When disabled, messages are flushed based on other conditions (such as count or period).

Type: int

Default: 0

`batching.check`

A Bloblang query that returns a boolean value indicating whether a message should end a batch.

Type: string

Default: ""

# Examples:
check: this.type == "end_of_transaction"

`batching.count`

The number of messages at which the batch is flushed. Set to 0 to disable count-based batching.

Type: int

Default: 0

`batching.period`

The length of time after which an incomplete batch is flushed regardless of its size. This field accepts Go duration format strings such as 100ms, 1s, or 5s. Supported time units are ns, us, ms, s, m, and h.

Type: string

Default: ""

# Examples:
period: 1s

# ---

period: 1m

# ---

period: 500ms

`batching.processors[]`

A list of processors to apply to a batch as it is flushed. This allows you to aggregate and archive the batch however you see fit. All resulting messages are flushed as a single batch, so splitting the batch into smaller batches with these processors has no effect.

Type: array<processor>

# Examples:
processors:
  - archive:
      format: concatenate


# ---

processors:
  - archive:
      format: lines


# ---

processors:
  - archive:
      format: json_array

`client_id`

The client ID sent to brokers with every request, which lets brokers attribute requests to this client in their logs, metrics, and client quotas.

Type: string

Default: benthos

`compression`

The compression algorithm to use.

Type: string

Default: none

Options: none, snappy, lz4, gzip, zstd

`custom_topic_creation`

If enabled, topics will be created with the specified number of partitions and replication factor if they do not already exist.

Requires version 4.23.0 or later.

Type: object

`custom_topic_creation.enabled`

Whether to enable custom topic creation.

Type: bool

Default: false

`custom_topic_creation.partitions`

The number of partitions to create for new topics. Leave at -1 to use the broker configured default. Must be >= 1.

Type: int

Default: -1

`custom_topic_creation.replication_factor`

The replication factor to use for new topics. Leave at -1 to use the broker configured default. Must be an odd number, and less then or equal to the number of brokers.

Type: int

Default: -1

`idempotent_write`

Enable the idempotent write producer option. This requires the IDEMPOTENT_WRITE permission on CLUSTER and can be disabled if this permission is not available.

Requires version 4.26.0 or later.

Type: bool

Default: false

`inject_tracing_map`

EXPERIMENTAL: A Bloblang mapping used to inject an object containing tracing propagation information into outbound messages. The specification of the injected fields will match the format used by the service wide tracer.

Requires version 3.45.0 or later.

Type: string

# Examples:
inject_tracing_map: meta = @.merge(this)

# ---

inject_tracing_map: root.meta.span = this

`key`

An optional key to populate for each message.

This field supports interpolation functions.

Type: string

Default: ""

`max_in_flight`

The maximum number of messages to have in flight at a given time. For outputs that send messages in batches, this limit applies to message batches. Increase this value to improve throughput.

Type: int

Default: 64

`max_msg_bytes`

The maximum size in bytes of messages sent to the target topic.

Type: int

Default: 1000000

`max_retries`

The maximum number of retries before giving up on the request. If set to zero there is no discrete limit.

Type: int

Default: 0

`metadata`

Specify which metadata values are added to each record as Kafka headers. Headers are only sent when target_version is 0.11.0 or later.

Type: object

`metadata.exclude_prefixes[]`

Provide a list of explicit metadata key prefixes to exclude when adding metadata to sent messages.

Type: array<string>

Default: []

`partition`

The manually-specified partition to publish messages to, relevant only when the field partitioner is set to manual. Must be able to parse as a 32-bit integer.

This field supports interpolation functions.

Type: string

Default: ""

`partitioner`

The partitioning algorithm to use.

Type: string

Default: fnv1a_hash

Options: fnv1a_hash, murmur2_hash, random, round_robin, manual

`rack_id`

A rack identifier for this client.

Type: string

Default: ""

`retry_as_batch`

When enabled forces an entire batch of messages to be retried if any individual message fails on a send, otherwise only the individual messages that failed are retried. Disabling this helps to reduce message duplicates during intermittent errors, but also makes it impossible to guarantee strict ordering of messages.

Type: bool

Default: false

`sasl`

Enables SASL authentication.

Type: object

`sasl.access_token`

A static OAUTHBEARER access token

Type: string

Default: ""

`sasl.mechanism`

The SASL authentication mechanism, if left empty SASL authentication is not used.

Type: string

Default: none

Option Summary

Option	Summary
`OAUTHBEARER`	OAuth Bearer based authentication.
`PLAIN`	Plain text authentication. NOTE: When using plain text auth it is extremely likely that you’ll also need to enable TLS.
`SCRAM-SHA-256`	Authentication using the SCRAM-SHA-256 mechanism.
`SCRAM-SHA-512`	Authentication using the SCRAM-SHA-512 mechanism.
`none`	Default, no SASL authentication.

OAUTHBEARER

OAuth Bearer based authentication.

PLAIN

Plain text authentication. NOTE: When using plain text auth it is extremely likely that you’ll also need to enable TLS.

SCRAM-SHA-256

Authentication using the SCRAM-SHA-256 mechanism.

SCRAM-SHA-512

Authentication using the SCRAM-SHA-512 mechanism.

none

Default, no SASL authentication.

`sasl.password`

A PLAIN password. It is recommended that you use environment variables to populate this field.

This field contains sensitive information that usually shouldn’t be added to a configuration directly. For more information, see Secrets.

Type: string

Default: ""

# Examples:
password: ${PASSWORD}

`sasl.token_cache`

Instead of using a static access_token allows you to query a cache resource to fetch OAUTHBEARER tokens from

Type: string

Default: ""

`sasl.token_key`

Required when using a token_cache, the key to query the cache with for tokens.

Type: string

Default: ""

`sasl.user`

A PLAIN username. It is recommended that you use environment variables to populate this field.

Type: string

Default: ""

# Examples:
user: ${USER}

`static_headers`

An optional map of static headers that should be added to messages in addition to metadata.

Type: object<string>

# Examples:
static_headers:
  first-static-header: value-1
  second-static-header: value-2

`target_version`

The version of the Kafka protocol to use. This limits the capabilities used by the client and should ideally match the version of your brokers. Defaults to the oldest supported stable version.

Type: string

# Examples:
target_version: 2.1.0

# ---

target_version: 3.1.0

`timeout`

The maximum period of time to wait for message sends before abandoning the request and retrying.

Type: string

Default: 5s

`timestamp_ms`

An optional timestamp to set for each message, in milliseconds since the Unix epoch. When left empty, the current timestamp is used. You cannot set both timestamp and timestamp_ms.

This field supports interpolation functions.

Requires version 4.40.0 or later.

Type: string

# Examples:
timestamp_ms: ${! timestamp_unix_milli() }

# ---

timestamp_ms: ${! metadata("kafka_timestamp_ms") }

`tls`

Configure Transport Layer Security (TLS) settings to secure network connections. This includes options for standard TLS as well as mutual TLS (mTLS) authentication where both client and server authenticate each other using certificates. Key configuration options include enabled to enable TLS, client_certs for mTLS authentication, root_cas/root_cas_file for custom certificate authorities, and skip_cert_verify for development environments.

Type: object

`tls.client_certs[]`

A list of client certificates for mutual TLS (mTLS) authentication. Configure this field to enable mTLS, authenticating the client to the server with these certificates.

You must set tls.enabled: true for the client certificates to take effect.

Certificate pairing rules: For each certificate item, provide either:

Inline PEM data using both cert and key or
File paths using both cert_file and key_file.

Mixing inline and file-based values within the same item is not supported.

Type: array<object>

Default: []

# Examples:
client_certs:
  - cert: foo
    key: bar


# ---

client_certs:
  - cert_file: ./example.pem
    key_file: ./example.key

`tls.client_certs[].cert`

The plaintext certificate to use for TLS authentication. Must be paired with the corresponding private key in the key field when using inline PEM data for mTLS client certificates.

Type: string

Default: ""

`tls.client_certs[].cert_file`

The path to a file containing the certificate to use for TLS authentication. Must be paired with the corresponding private key file in the key_file field when using file-based configuration for mTLS client certificates.

Type: string

Default: ""

`tls.client_certs[].key`

Private key for mTLS client certificate as inline PEM data. Must correspond to the client certificate specified in the cert field. Use this field together with cert when providing certificate data inline rather than through files.

This field contains sensitive information that usually shouldn’t be added to a configuration directly. For more information, see Secrets.

Type: string

Default: ""

`tls.client_certs[].key_file`

Path to private key file for mTLS client certificate in PEM format. Must correspond to the client certificate specified in the cert_file field. Use this field together with cert_file when loading certificate data from files.

Type: string

Default: ""

`tls.client_certs[].password`

The password to use for the private key (specified in the key or key_file fields), if it is password-protected. The PKCS#1 and PKCS#8 formats are supported. Supports environment variable interpolation for secure password management.

The pbeWithMD5AndDES-CBC algorithm is obsolete and not supported for the PKCS#8 format. This algorithm does not authenticate the ciphertext, making it vulnerable to padding oracle attacks that can let an attacker recover the plaintext.

This field contains sensitive information that usually shouldn’t be added to a configuration directly. For more information, see Secrets.

Requires version 4.3.0 or later.

Type: string

Default: ""

# Examples:
password: foo

# ---

password: ${KEY_PASSWORD}

`tls.enable_renegotiation`

Whether to allow the remote server to repeatedly request renegotiation. Enable this option if you’re seeing the error message local error: tls: no renegotiation.

Requires version 3.45.0 or later.

Type: bool

Default: false

`tls.enabled`

Whether to enable TLS for secure connections. Set to true to enable TLS encryption. Required to be true for other TLS options (like client_certs, root_cas, etc.) to take effect.

Type: bool

Default: false

`tls.root_cas`

Specify a root certificate authority to use (optional). This is a string that represents a certificate chain from the parent-trusted root certificate, through possible intermediate signing certificates, to the host certificate. Use either this field for inline certificate data or root_cas_file for file-based certificate loading.

This field contains sensitive information that usually shouldn’t be added to a configuration directly. For more information, see Secrets.

Type: string

Default: ""

# Examples:
root_cas: |-
  -----BEGIN CERTIFICATE-----
  ...
  -----END CERTIFICATE-----

`tls.root_cas_file`

Specify the path to a root certificate authority file (optional). This is a file, often with a .pem extension, which contains a certificate chain from the parent-trusted root certificate, through possible intermediate signing certificates, to the host certificate. Use either this field for file-based certificate loading or root_cas for inline certificate data.

Type: string

Default: ""

# Examples:
root_cas_file: ./root_cas.pem

`tls.skip_cert_verify`

Whether to skip server-side certificate verification. Set to true only for testing environments as this reduces security by disabling certificate validation. When using self-signed certificates or in development, this may be necessary, but should never be used in production. Consider using root_cas or root_cas_file to specify trusted certificates instead of disabling verification entirely.

Type: bool

Default: false

`topic`

The topic to publish messages to.

This field supports interpolation functions.

Type: string

Was this helpful?

group Ask in the community

mail Share your feedback

What do you think of this page?

Let us know more:

Let us contact you about your feedback:

kafka

Strict ordering and retries

Troubleshooting

Performance

Fields

ack_replicas

addresses[]

backoff

backoff.initial_interval

backoff.max_elapsed_time

backoff.max_interval

batching

batching.byte_size

batching.check

batching.count

batching.period

batching.processors[]

client_id

compression

custom_topic_creation

custom_topic_creation.enabled

custom_topic_creation.partitions

custom_topic_creation.replication_factor

idempotent_write

inject_tracing_map

key

max_in_flight

max_msg_bytes

max_retries

metadata

metadata.exclude_prefixes[]

partition

partitioner

rack_id

retry_as_batch

sasl

sasl.access_token

sasl.mechanism

sasl.password

sasl.token_cache

sasl.token_key

sasl.user

static_headers

target_version

timeout

timestamp_ms

tls

tls.client_certs[]

tls.client_certs[].cert

tls.client_certs[].cert_file

tls.client_certs[].key

tls.client_certs[].key_file

tls.client_certs[].password

tls.enable_renegotiation

tls.enabled

tls.root_cas

tls.root_cas_file

tls.skip_cert_verify

topic

`ack_replicas`

`addresses[]`

`backoff`

`backoff.initial_interval`

`backoff.max_elapsed_time`

`backoff.max_interval`

`batching`

`batching.byte_size`

`batching.check`

`batching.count`

`batching.period`

`batching.processors[]`

`client_id`

`compression`

`custom_topic_creation`

`custom_topic_creation.enabled`

`custom_topic_creation.partitions`

`custom_topic_creation.replication_factor`

`idempotent_write`

`inject_tracing_map`

`key`

`max_in_flight`

`max_msg_bytes`

`max_retries`

`metadata`

`metadata.exclude_prefixes[]`

`partition`

`partitioner`

`rack_id`

`retry_as_batch`

`sasl`

`sasl.access_token`

`sasl.mechanism`

`sasl.password`

`sasl.token_cache`

`sasl.token_key`

`sasl.user`

`static_headers`

`target_version`

`timeout`

`timestamp_ms`

`tls`

`tls.client_certs[]`

`tls.client_certs[].cert`

`tls.client_certs[].cert_file`

`tls.client_certs[].key`

`tls.client_certs[].key_file`

`tls.client_certs[].password`

`tls.enable_renegotiation`

`tls.enabled`

`tls.root_cas`

`tls.root_cas_file`

`tls.skip_cert_verify`

`topic`