Connect
Also in Cloud

salesforce_sink

License: This component requires an enterprise license. You can either upgrade to an Enterprise Edition license, or generate a trial license key that's valid for 30 days.

Writes messages to Salesforce, routing each Kafka topic to its own sObject configuration.

Introduced in version 4.85.0.

Consumes batches of messages and writes them to Salesforce. Each message must have a topic field (set by the per-topic processor) and a data field containing the Salesforce record fields. The topic is used to look up the correct topic_mappings entry which defines the sObject, operation, and write mode.

Realtime mode uses the sObject Collections REST API (synchronous, up to 200 records/call). Bulk mode uses the Bulk API 2.0 (asynchronous, polls until complete).

  • Common

  • Advanced

output:
  label: ""
  salesforce_sink:
    org_url: "" # No default (required)
    client_id: "" # No default (required)
    client_secret: "" # No default (required)
    api_version: v65.0
    bulk_batch_size: 1000
    max_concurrent_bulk_jobs: 10
    bulk_poll_interval: 5s
    batch_period: 5s
    max_in_flight: 1
    topic_mappings: [] # No default (required)
output:
  label: ""
  salesforce_sink:
    org_url: "" # No default (required)
    client_id: "" # No default (required)
    client_secret: "" # No default (required)
    api_version: v65.0
    bulk_batch_size: 1000
    max_concurrent_bulk_jobs: 10
    bulk_poll_interval: 5s
    batch_period: 5s
    max_in_flight: 1
    topic_mappings: [] # No default (required)
    http:
      timeout: 5s
      tls:
        enabled: false
        skip_cert_verify: false
        enable_renegotiation: false
        root_cas: ""
        root_cas_file: ""
        client_certs: []
      proxy_url: ""
      disable_http2: false
      tps_limit: 0
      tps_burst: 1
      backoff:
        initial_interval: 1s
        max_interval: 30s
        max_retries: 3
      tcp:
        connect_timeout: 0s
        keep_alive:
          idle: 15s
          interval: 15s
          count: 9
        tcp_user_timeout: 0s
      http:
        max_idle_conns: 100
        max_idle_conns_per_host: 0
        max_conns_per_host: 64
        idle_conn_timeout: 1m30s
        tls_handshake_timeout: 10s
        expect_continue_timeout: 1s
        response_header_timeout: 0s
        disable_keep_alives: false
        disable_compression: false
        max_response_header_bytes: 1048576
        max_response_body_bytes: 10485760
        write_buffer_size: 4096
        read_buffer_size: 4096
        h2:
          strict_max_concurrent_requests: false
          max_decoder_header_table_size: 4096
          max_encoder_header_table_size: 4096
          max_read_frame_size: 16384
          max_receive_buffer_per_connection: 1048576
          max_receive_buffer_per_stream: 1048576
          send_ping_timeout: 0s
          ping_timeout: 15s
          write_byte_timeout: 0s
      access_log_level: ""
      access_log_body_limit: 0

Fields

api_version

Salesforce REST API version to target, prefixed with v. Affects endpoint paths (/services/data/{api_version}/…​) and available fields/objects. Must be supported by your org; check Setup → Company Information. Older versions may lack recent fields.

Requires version 4.90.3 or later.

Type: string

Default: v65.0

# Examples:
api_version: v65.0

# ---

api_version: v62.0

batch_period

Maximum period to wait before flushing an incomplete batch.

Type: string

Default: 5s

bulk_batch_size

Number of records per bulk job. Also controls the output batch size.

Type: int

Default: 1000

bulk_poll_interval

How often to poll Salesforce for bulk job completion status.

Type: string

Default: 5s

client_id

Consumer Key of the Salesforce Connected App authorized for the OAuth Client Credentials flow. Create the Connected App under Setup → App Manager → New Connected App, enable OAuth settings, enable the Client Credentials Flow under Flow Enablement, then copy the Consumer Key from Manage Consumer Details.

Type: string

client_secret

Consumer Secret of the Salesforce Connected App, paired with client_id. Sensitive; prefer environment variable interpolation (${SALESFORCE_CLIENT_SECRET}) over inlining.

This field contains sensitive information that usually shouldn’t be added to a configuration directly. For more information, see Secrets.

Type: string

http

HTTP client configuration for Salesforce REST calls (OAuth token endpoint and, where applicable, data queries).

Requires version 4.90.3 or later.

Type: object

http.access_log_body_limit

Maximum bytes of request/response body to include in logs. 0 to skip body logging.

Type: int

Default: 0

http.access_log_level

Log level for HTTP request/response logging. Empty disables logging.

Type: string

Default: ""

Options: "", TRACE, DEBUG, INFO, WARN, ERROR

http.backoff

Adaptive backoff configuration for 429 (Too Many Requests) responses. Always active.

Type: object

http.backoff.initial_interval

Initial interval between retries on 429 responses.

Type: string

Default: 1s

http.backoff.max_interval

Maximum interval between retries on 429 responses.

Type: string

Default: 30s

http.backoff.max_retries

Maximum number of retries on 429 responses.

Type: int

Default: 3

http.disable_http2

Disable HTTP/2 and force HTTP/1.1.

Type: bool

Default: false

http.http

HTTP transport settings controlling connection pooling, timeouts, and HTTP/2.

Type: object

http.http.disable_compression

Disable automatic decompression of gzip responses.

Type: bool

Default: false

http.http.disable_keep_alives

Disable HTTP keep-alive connections; each request uses a new connection.

Type: bool

Default: false

http.http.expect_continue_timeout

Maximum time to wait for a server’s 100-continue response before sending the body. 0 means the body is sent immediately.

Type: string

Default: 1s

http.http.h2

HTTP/2-specific transport settings. Only applied when HTTP/2 is enabled.

Type: object

http.http.h2.max_decoder_header_table_size

Upper limit in bytes for the HPACK header table used to decode headers from the peer. Must be less than 4 MiB.

Type: int

Default: 4096

http.http.h2.max_encoder_header_table_size

Upper limit in bytes for the HPACK header table used to encode headers sent to the peer. Must be less than 4 MiB.

Type: int

Default: 4096

http.http.h2.max_read_frame_size

Largest HTTP/2 frame this endpoint will read. Valid range: 16 KiB to 16 MiB.

Type: int

Default: 16384

http.http.h2.max_receive_buffer_per_connection

Maximum flow-control window size in bytes for data received on a connection. Must be at least 64 KiB and less than 4 MiB.

Type: int

Default: 1048576

http.http.h2.max_receive_buffer_per_stream

Maximum flow-control window size in bytes for data received on a single stream. Must be less than 4 MiB.

Type: int

Default: 1048576

http.http.h2.ping_timeout

Timeout waiting for a PING response before closing the connection.

Type: string

Default: 15s

http.http.h2.send_ping_timeout

Idle timeout after which a PING frame is sent to verify connection health. 0 disables health checks.

Type: string

Default: 0s

http.http.h2.strict_max_concurrent_requests

When true, new requests block when a connection’s concurrency limit is reached instead of opening a new connection.

Type: bool

Default: false

http.http.h2.write_byte_timeout

Timeout for writing data to a connection. The timer resets whenever bytes are written. 0 disables the timeout.

Type: string

Default: 0s

http.http.idle_conn_timeout

How long an idle connection remains in the pool before being closed. 0 disables the timeout.

Type: string

Default: 1m30s

http.http.max_conns_per_host

Maximum total connections (active + idle) per host. 0 means unlimited.

Type: int

Default: 64

http.http.max_idle_conns

Maximum total number of idle (keep-alive) connections across all hosts. 0 means unlimited.

Type: int

Default: 100

http.http.max_idle_conns_per_host

Maximum idle connections to keep per host. 0 (the default) uses GOMAXPROCS+1.

Type: int

Default: 0

http.http.max_response_body_bytes

Maximum bytes of response body the client will read. The response body is wrapped with a limit reader; reads beyond this cap return EOF. 0 disables the limit.

Type: int

Default: 10485760

http.http.max_response_header_bytes

Maximum bytes of response headers to allow.

Type: int

Default: 1048576

http.http.read_buffer_size

Size in bytes of the per-connection read buffer.

Type: int

Default: 4096

http.http.response_header_timeout

Maximum time to wait for response headers after writing the full request. 0 disables the timeout.

Type: string

Default: 0s

http.http.tls_handshake_timeout

Maximum time to wait for a TLS handshake to complete. 0 disables the timeout.

Type: string

Default: 10s

http.http.write_buffer_size

Size in bytes of the per-connection write buffer.

Type: int

Default: 4096

http.proxy_url

HTTP proxy URL. Empty string disables proxying.

Type: string

Default: ""

http.tcp

Configure TCP socket-level settings to optimize network performance and reliability. These low-level controls are useful for:

  • Unresponsive hosts: Set connect_timeout to limit how long a connection attempt can take (the default 0s sets no limit)

  • Long-lived connections: Configure keep_alive settings to detect and recover from stale connections

  • Unstable networks: Tune keep-alive probes to balance between quick failure detection and avoiding false positives

  • Linux systems with specific requirements: Use tcp_user_timeout (Linux 2.6.37+) to control data acknowledgment timeouts

Most users should keep the default values. Only modify these settings if you’re experiencing connection stability issues or have specific network requirements.

Type: object

http.tcp.connect_timeout

Maximum amount of time a dial will wait for a connect to complete. Zero disables.

Type: string

Default: 0s

http.tcp.keep_alive

TCP keep-alive probe configuration.

Type: object

http.tcp.keep_alive.count

Maximum unanswered keep-alive probes before dropping the connection. Zero defaults to 9.

Type: int

Default: 9

http.tcp.keep_alive.idle

Duration the connection must be idle before sending the first keep-alive probe. Zero defaults to 15s. Negative values disable keep-alive probes.

Type: string

Default: 15s

http.tcp.keep_alive.interval

Duration between keep-alive probes. Zero defaults to 15s.

Type: string

Default: 15s

http.tcp.tcp_user_timeout

Maximum time to wait for acknowledgment of transmitted data before killing the connection. Linux-only (kernel 2.6.37+), ignored on other platforms. When enabled, keep_alive.idle must be greater than this value per RFC 5482. Zero disables.

Type: string

Default: 0s

http.timeout

HTTP request timeout.

Type: string

Default: 5s

http.tls

Configure Transport Layer Security (TLS) settings to secure network connections. This includes options for standard TLS as well as mutual TLS (mTLS) authentication where both client and server authenticate each other using certificates. Key configuration options include enabled to enable TLS, client_certs for mTLS authentication, root_cas/root_cas_file for custom certificate authorities, and skip_cert_verify for development environments.

Type: object

http.tls.client_certs[]

A list of client certificates for mutual TLS (mTLS) authentication. Configure this field to enable mTLS, authenticating the client to the server with these certificates.

You must set tls.enabled: true for the client certificates to take effect.

Certificate pairing rules: For each certificate item, provide either:

  • Inline PEM data using both cert and key or

  • File paths using both cert_file and key_file.

Mixing inline and file-based values within the same item is not supported.

Type: array<object>

Default: []

# Examples:
client_certs:
  - cert: foo
    key: bar


# ---

client_certs:
  - cert_file: ./example.pem
    key_file: ./example.key

http.tls.client_certs[].cert

The plaintext certificate to use for TLS authentication. Must be paired with the corresponding private key in the key field when using inline PEM data for mTLS client certificates.

Type: string

Default: ""

http.tls.client_certs[].cert_file

The path to a file containing the certificate to use for TLS authentication. Must be paired with the corresponding private key file in the key_file field when using file-based configuration for mTLS client certificates.

Type: string

Default: ""

http.tls.client_certs[].key

Private key for mTLS client certificate as inline PEM data. Must correspond to the client certificate specified in the cert field. Use this field together with cert when providing certificate data inline rather than through files.

This field contains sensitive information that usually shouldn’t be added to a configuration directly. For more information, see Secrets.

Type: string

Default: ""

http.tls.client_certs[].key_file

Path to private key file for mTLS client certificate in PEM format. Must correspond to the client certificate specified in the cert_file field. Use this field together with cert_file when loading certificate data from files.

Type: string

Default: ""

http.tls.client_certs[].password

The password to use for the private key (specified in the key or key_file fields), if it is password-protected. The PKCS#1 and PKCS#8 formats are supported. Supports environment variable interpolation for secure password management.

The pbeWithMD5AndDES-CBC algorithm is obsolete and not supported for the PKCS#8 format. This algorithm does not authenticate the ciphertext, making it vulnerable to padding oracle attacks that can let an attacker recover the plaintext.

This field contains sensitive information that usually shouldn’t be added to a configuration directly. For more information, see Secrets.

Type: string

Default: ""

# Examples:
password: foo

# ---

password: ${KEY_PASSWORD}

http.tls.enable_renegotiation

Whether to allow the remote server to repeatedly request renegotiation. Enable this option if you’re seeing the error message local error: tls: no renegotiation.

Type: bool

Default: false

http.tls.enabled

Whether to enable TLS for secure connections. Set to true to enable TLS encryption. Required to be true for other TLS options (like client_certs, root_cas, etc.) to take effect.

Type: bool

Default: false

http.tls.root_cas

Specify a root certificate authority to use (optional). This is a string that represents a certificate chain from the parent-trusted root certificate, through possible intermediate signing certificates, to the host certificate. Use either this field for inline certificate data or root_cas_file for file-based certificate loading.

This field contains sensitive information that usually shouldn’t be added to a configuration directly. For more information, see Secrets.

Type: string

Default: ""

# Examples:
root_cas: |-
  -----BEGIN CERTIFICATE-----
  ...
  -----END CERTIFICATE-----

http.tls.root_cas_file

Specify the path to a root certificate authority file (optional). This is a file, often with a .pem extension, which contains a certificate chain from the parent-trusted root certificate, through possible intermediate signing certificates, to the host certificate. Use either this field for file-based certificate loading or root_cas for inline certificate data.

Type: string

Default: ""

# Examples:
root_cas_file: ./root_cas.pem

http.tls.skip_cert_verify

Whether to skip server-side certificate verification. Set to true only for testing environments as this reduces security by disabling certificate validation. When using self-signed certificates or in development, this may be necessary, but should never be used in production. Consider using root_cas or root_cas_file to specify trusted certificates instead of disabling verification entirely.

Type: bool

Default: false

http.tps_burst

Maximum burst size for rate limiting.

Type: int

Default: 1

http.tps_limit

Rate limit in requests per second. 0 disables rate limiting.

Type: float

Default: 0

max_concurrent_bulk_jobs

Maximum number of bulk jobs polling concurrently in the background. Each in-flight job buffers its CSV payload in memory. Lower this value if memory usage is a concern.

Type: int

Default: 10

max_in_flight

Maximum number of batches to send concurrently. Increasing this value improves real-time write throughput.

Type: int

Default: 1

org_url

Salesforce instance base URL for your org, protocol included and no trailing slash. Used as the base for both the OAuth token endpoint and REST queries. Production orgs use https://{my-domain}.my.salesforce.com; sandboxes use https://{my-domain}.sandbox.my.salesforce.com. Legacy instance URLs (https://na123.salesforce.com) still work but My Domain URLs are strongly recommended by Salesforce.

Type: string

# Examples:
org_url: https://acme.my.salesforce.com

# ---

org_url: https://acme--staging.sandbox.my.salesforce.com

topic_mappings[]

Per-topic Salesforce write configuration. Each entry maps a topic to an sObject and write settings.

Type: array<object>

topic_mappings[].all_or_none

Real-time only: rolls back every record in a request if any record in it fails. Real-time writes send at most 200 records per request, so a larger batch can be partly committed.

Type: bool

Default: false

topic_mappings[].external_id_field

External ID field name. Required for upsert operations.

Type: string

Default: ""

topic_mappings[].mode

Write mode: realtime (sObject Collections API) or bulk (Bulk API 2.0).

Type: string

Default: realtime

topic_mappings[].operation

Write operation: insert, update, upsert, or delete.

Type: string

Default: upsert

topic_mappings[].sobject

Salesforce sObject API name (for example, Account, Contact, MyObject__c).

Type: string

topic_mappings[].topic

The topic name to match against the message’s topic field.

Type: string