# Azure Data Lake Storage Gen2 Sink Connector for Confluent Cloud The fully managed Azure Data Lake Storage Gen2 Sink connector for Confluent Cloud exports Avro, JSON Schema, Protobuf, JSON (schemaless), or Bytes data from Apache Kafka® topics to Azure storage in Avro, Parquet, JSON, or Bytes format. Depending on your configuration, the Azure Data Lake Storage Gen2 (ADLS Gen2) Sink connector can export data by guaranteeing exactly-once delivery semantics to consumers of the Azure Data Lake Storage Gen2 files it produces. The ADLS Gen2 Sink connector periodically polls data from Kafka and, in turn, uploads it to Azure Data Lake storage. A partitioner is used to split the data of every Kafka partition into chunks. Each chunk of data is represented as an Azure Data Lake Storage Gen2 file. The key name encodes the topic, the Kafka partition, and the start offset of this data chunk. The size of each data chunk is determined by the number of records written to Azure Data Lake storage and by schema compatibility. Confluent Cloud is available through [Azure Marketplace](https://azuremarketplace.microsoft.com/en/marketplace/apps/confluentinc.confluent-cloud-azure-prod?tab=Overview) or [directly from Confluent](https://www.confluent.io/get-started/). #### NOTE * This Quick Start is for the fully managed Confluent Cloud connector. If you are installing the connector locally for Confluent Platform, see [Azure Data Lake Storage Gen2 Sink connector for Confluent Platform](https://docs.confluent.io/kafka-connectors/azure-data-lake-gen2-sink/current/). * If you require private networking for fully managed connectors, make sure to set up the proper networking beforehand. For more information, see [Manage Networking for Confluent Cloud Connectors](networking/internet-resource.md#clusters-connect-cloud). ## Features The Azure Data Lake Storage Gen2 (ADLS Gen2) Sink connector provides the following features: * **Write once, read many (WORM) support**: The connector supports WORM-enabled Azure Data Lake Storage Gen2 containers. Since data cannot be modified or deleted once written, the connector only supports at-least-once delivery semantics. As a prerequisite, the immutability policies must enable the `AllowProtectedAppendWritesAll` property. For more information, see [Allow protected writes](https://learn.microsoft.com/en-us/azure/storage/blobs/immutable-container-level-worm-policies#allow-protected-append-blobs-writes). * **Provider integration support**: The connector supports Microsoft’s native identity authorization using Confluent Provider Integration. For more information about provider integration setup, see the [connector authentication](#cc-azure-datalakegen2-sink-setup-connection). * **Client-side encryption (CSFLE and CSPE) support**: The connector supports CSFLE and CSPE for sensitive data. For more information about CSFLE or CSPE setup, see the [connector configuration](#cc-azure-datalakegen2-sink-setup-connection). * **Exactly Once Delivery**: Records that are exported using a deterministic partitioner are delivered with exactly-once semantics regardless of the eventual consistency of Azure Data Lake storage, provided that the WORM is not enabled on the container. * **Data formats with or without a schema:** The connector supports Avro, JSON Schema, Protobuf, or JSON (schemaless) input data formats and Avro, Parquet, JSON, and Bytes output formats. [Schema Registry](../get-started/schema-registry.md#cloud-sr-config) must be enabled to use a Schema Registry-based format (for example, Avro, JSON Schema, or Protobuf). * **Schema Evolution**: `schema.compatibility` is set to `NONE`. * **Scheduled Rotation and Rotation Interval**: The connector supports a regularly scheduled interval for closing and uploading files to storage. See [Scheduled Rotation](#az-datalake-storage-scheduled-rotation) for details. * **Partitioner**: The connector supports two classes for partitioning data: > * `Time-Based Partitioner`: The connector supports the `TimeBasedPartitioner` class based on the Kafka class `TimeStamp`. Time-based partitioning options are daily or hourly. > * `Default Partitioner`: The connector supports the `DefaultPartitioner` class, which writes all records to files within a single directory, without time-based separation. * **Flush size:** Defaults to 1000. The value can be increased if needed. The value can be lowered (1 minimum) if you are running a [Dedicated Confluent Cloud cluster](../clusters/cluster-types.md#dedicated-cluster). The minimum value is 1000 for non-dedicated clusters. The following scenarios describe a couple of ways records may be flushed to storage: * You use the default setting of 1000 and your topic has six partitions. Files start to be created in storage after more than 1000 records exist in each partition. * You use the default setting of 1000 and the partitioner is set to Hourly. 500 records arrive at one partition from 2:00pm to 3:00pm. At 3:00pm, an additional 5 records arrive at the partition. You will see 500 records in storage at 3:00pm. #### NOTE The properties `rotate.schedule.interval.ms` and `rotate.interval.ms` can be used with `flush.size` to determine when files are created in storage. These parameters kick in and files are stored based on which condition is met first. For FieldPartitioner in fully managed connectors, an additional automatic rotation occurs when the number of open files reaches 50. This uploads the current batch of files to storage and creates a new batch. For example: You have one topic partition. You set `flush.size=1000` and `rotate.schedule.interval.ms=600000` (10 minutes). 500 records arrive at the topic partition from 12:01 to 12:10. 500 additional records arrive from 12:11 to 12:20. You will see two files in the storage bucket with 500 records in each file. This is because the 10 minute `rotate.schedule.interval.ms` condition tripped before the `flush.size=1000` condition was met. * **Secret manager integration**: The connector supports secret manager integration. For `Storage Account Key` and `OAuth Client Credential` based authentication methods, the connector can retrieve the following configurations from an integrated secret manager at runtime as needed. | **Secret manager managed configuration** | **Type** | **Authentication method** | |--------------------------------------------|------------|-----------------------------| | `azure.datalake.gen2.access.key` | `PASSWORD` | Storage Account Key | | `azure.datalake.gen2.client.id` | `STRING` | OAuth Client Credential | | `azure.datalake.gen2.client.key` | `PASSWORD` | OAuth Client Credential | | `azure.datalake.gen2.token.endpoint` | `STRING` | OAuth Client Credential | For more information, see [Create a secret manager integration in Confluent Cloud](secret-manager-integration/overview.md#cloud-secret-manager-quickstart). For more information and examples to use with the Confluent Cloud API for Connect, see the [Confluent Cloud API for Connect Usage Examples](connect-api-section.md#ccloud-connect-api) section. ## Limitations Be sure to review the following information. * For connector limitations, see [Azure Data Lake Storage Gen2 Sink Connector](limits.md#azure-datalakegen2-sink-limits) limitations. * If you plan to use one or more Single Message Transformations (SMTs), see [SMT Limitations](single-message-transforms.md#cc-single-message-transforms-limitations). ## Azure Storage Authentication The following provides basic information about setting up connector access to Azure storage. Before continuing, you should be familiar with [accessing blobs using Azure Active Directory](https://docs.microsoft.com/en-us/azure/storage/blobs/authorize-access-azure-active-directory). There are two ways to set up authentication for your connector to access Azure: [Basic authentication](#cc-azure-datalakegen2storage-sink-basic-auth) or [Active Directory authentication](#cc-azure-datalakegen2storage-sink-ad-auth). ### Basic authentication The highlighted properties are required for basic authentication. Basic authentication is typically used to test the connector in development. You provide a storage account name and the storage access key.  ### Active Directory authentication The highlighted properties are required for authentication with Active Directory (AD).  When authenticating with AD, you first need to establish the relationship between the connector and the Microsoft identity platform. You do this by registering the connector as a [trusted application](https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app). Once you have registered the application, you can get or create the following items from the Azure portal or using the [Azure CLI](https://docs.microsoft.com/en-us/cli/azure/ad?view=azure-cli-latest): - **Client ID**: In Azure, this is the *Application (client) ID* created when registering the application. It is displayed in the Azure portal or you can get it using the [Azure CLI](https://docs.microsoft.com/en-us/cli/azure/ad?view=azure-cli-latest).  - **Client Key**: In Azure, this is the *Client secret* you create after registering the AD application. The example below shows what this looks like in the Azure portal.  - **Azure Token Endpoint**: The OAuth 2.0 token endpoint is created automatically when you register the application with AD. You can find these in the dashboard for the AD application. Copy and paste the *OAuth 2.0 token endpoint (v1)* into the property.  ### Minimum role permission You must create a role assignment for the connector to be able to access Azure Data Lake storage. Minimally, the connector requires the role `Storage Blob Data Contributor`. Custom Azure RBAC IAM roles are not supported. For information about assigning this role to the AD application, see [Assign roles](https://docs.microsoft.com/en-us/azure/databricks/data/data-sources/azure/adls-gen2/azure-datalake-gen2-sp-access#assign-roles). ### Azure CLI commands The following are a few example commands to use when setting up authentication for the connector. Be sure to use the latest version of the Azure CLI. To create the AD application for the connector: ```bash az ad app create --display-name \ --is-fallback-public-client false --sign-in-audience AzureADandPersonalMicrosoftAccount --query appId -o tsv ``` To create a service principal: ```bash az ad sp create --id ``` To assign the role `Storage Blob Data Contributor` to the service principal: ```bash az role assignment create --assignee \ --role "Storage Blob Data Contributor" ``` ## Quick Start Use this quick start to get up and running with the ADLS Gen2 Sink connector. The quick start provides the basics of selecting the connector and configuring it to stream events to Azure storage. Prerequisites : - Authorized access to a [Confluent Cloud](https://www.confluent.io/confluent-cloud/) cluster on Microsoft Azure. - The Confluent CLI installed and configured for the cluster. See [Install the Confluent CLI](https://docs.confluent.io/confluent-cli/current/install.html). - [Schema Registry](../get-started/schema-registry.md#cloud-sr-config) must be enabled to use a Schema Registry-based format (for example, Avro, JSON_SR (JSON Schema), or Protobuf). - Azure Data Lake storage should be in the same region as your Confluent Cloud cluster. If you use a different region, be aware that you may incur additional data transfer charges. Contact [Confluent Support](https://support.confluent.io) if you need to use Confluent Cloud and Azure Data Lake storage in different regions. - Authentication configured for Azure storage. For details, see [Azure Storage Authentication](#cc-azure-datalakegen2storage-sink-auth).
- Kafka cluster credentials. The following lists the different ways you can provide credentials. - Enter an existing [service account](service-account.md#s3-cloud-service-account) resource ID. - Create a Confluent Cloud [service account](service-account.md#s3-cloud-service-account) for the connector. Make sure to review the ACL entries required in the [service account documentation](service-account.md#s3-cloud-service-account). Some connectors have specific ACL requirements. - Create a Confluent Cloud API key and secret. To create a key and secret, you can use [confluent api-key create](https://docs.confluent.io/confluent-cli/current/command-reference/api-key/confluent_api-key_create.html) *or* you can autogenerate the API key and secret directly in the Cloud Console when setting up the connector. ### Using the Confluent Cloud Console #### Step 1: Launch your Confluent Cloud cluster To create and launch a Kafka cluster in Confluent Cloud, see [Create a kafka cluster in Confluent Cloud](../get-started/index.md#cloud-create-kafka-cluster). #### Step 2: Add a connector In the left navigation menu, click **Connectors**. If you already have connectors in your cluster, click **+ Add connector**. #### Step 3: Select your connector Click the **Azure Data Lake Storage Gen2 Sink** connector card.  #### Step 4: Enter the connector details #### NOTE * Ensure you have all your [prerequisites](#cc-datalake-gen2-sink-prereqs) completed. * An asterisk ( \* ) designates a required entry. At the **Add Azure Data Lake Storage Gen2 Sink Connector** screen, complete the following: ### Topic selection If you’ve already populated your Kafka topics, select the topics you want to connect from the **Topics** list. To create a new topic, click **+Add new topic**. ### Kafka access 1. Select the way you want to provide **Kafka Cluster credentials**. You can choose one of the following options: - **My account**: This setting allows your connector to globally access everything that you have access to. With a user account, the connector uses an API key and secret to access the Kafka cluster. This option is not recommended for production. - **Service account**: This setting limits the access for your connector by using a [service account](service-account.md#s3-cloud-service-account). This option is recommended for production. - **Use an existing API key**: This setting allows you to specify an API key and a secret pair. You can use an existing pair or create a new one. This method is not recommended for production environments. #### NOTE Freight clusters support only service accounts for Kafka authentication. 2. Click **Continue**. ### Authentication 1. Configure the authentication properties: **Authentication method** - **Authentication method**: Under **Azure credentials**, select how you want to authenticate with the database: - If you select **Storage Account Key**, enter the following Azure Data Lake storage details: * **Azure Data Lake Storage Gen2 Access Key**: The access key for the storage account. - If you select **Microsoft Entra ID application**, enter the following Azure details: * Under the **Provider integration** dropdown, select an existing integration name that has access to your Azure resource required to run this connector. For more information, see [Manage an Microsoft Azure Provider Integration](provider-integration.md#connector-az-pi). - If you select **OAuth Client Credential**, enter the following Azure Data Lake storage details: * **Client ID**: The client ID (GUID) of the client obtained from Azure Active Directory configuration. * **Client Key**: The secret key of the client. * **Azure Token Endpoint**: The OAuth 2.0 token endpoint associated with the user’s directory (obtain from Active Directory configuration). For more information, see [Azure Storage Authentication](#cc-azure-datalakegen2storage-sink-auth). - **Use secret manager**: Enable this setting to fetch sensitive configuration values, such as the `Azure Data Lake Storage Gen2 Access Key` or `OAuth Client Credential`, from a secret manager. **Azure credentials** - **Provider Integration**: Select an existing integration name that has access to your Azure resource required to run this connector. Required for: - `Microsoft Entra ID` authentication, or - `Azure Data Lake Storage Gen2 Access Key` and `OAuth Client Credential` authentication if those methods need a secret manager - **Azure Data Lake Storage Gen2 Access Key**: Access Key for the storage account. Required for `Storage Account Key` authentication. - **Client ID**: The client ID (GUID) of the client obtained from Azure Active Directory configuration. Required for `OAuth Client Credential` authentication. - **Client Key**: The secret key of the client. Required for `OAuth Client Credential` authentication. - **Azure Token Endpoint**: The OAuth 2.0 token endpoint associated with the user’s directory (obtain from Active Directory configuration). Required for `OAuth Client Credential` authentication. **Secret manager configuration** - **Secret manager**: Select the secret manager that Confluent Cloud should use to retrieve sensitive data. - **Configurations from Secret manager**: Select the configurations whose values Confluent Cloud should fetch from the secret manager. - **Provider Integration**: Select an existing integration name that has access to your Azure resource required to run this connector. Required for: - `Microsoft Entra ID` authentication, or - `Azure Data Lake Storage Gen2 Access Key` and `OAuth Client Credential` authentication if those methods need a secret manager **Destination** - **Azure Data Lake Storage Gen2 account name**: The account name for the storage account. Must be between 3-23 alphanumeric characters. - **Topic directory**: Top-level directory where ingested data is stored. 2. Click **Continue**. ### Configuration #### NOTE Configuration properties that are not shown in the Cloud Console use the default values. See [Azure Data Lake Storage Gen2 Sink Connector Configuration Properties](https://docs.confluent.io/kafka-connectors/azure-data-lake-gen2-sink/current/configuration_options.html) for default values and property definitions. - **Input Kafka record value format**: Select an input Kafka record value format (data coming from the Kafka topic). Valid entries are `AVRO`, `JSON_SR` (JSON Schema), `PROTOBUF`, `JSON` (schemaless), or `BYTES`. A valid schema must be available in [Schema Registry](../get-started/schema-registry.md#cloud-sr-config) to use a schema-based message format (for example, AVRO, JSON_SR, or PROTOBUF). #### NOTE Input format JSON to output format AVRO does not work for the connector. - **Output message format**: Select the output message format (data coming from the connector). Valid entries are `AVRO`, `PARQUET`, `JSON`, or `BYTES`. A valid schema must be available in [Schema Registry](../get-started/schema-registry.md#cloud-sr-config) to use a schema-based message format (for example, `AVRO`). For more information, - **Partitioner Class**: The partitioner to use when writing data to the Azure Data Lake Storage container. Supported values are `DefaultPartitioner` (organizes records by the topic partition) and `TimeBasedPartitioner` (organizes records by time, e.g., daily or hourly). - **Flush size**: Enter the **Flush size**. This value defaults to 1000. The default value can be raised (and lowered, if running a dedicated cluster). - **Path format**: This configuration is used to set the format of the data directories when partitioning with `TimeBasedPartitioner`. The format set in this configuration converts the Unix timestamp to a valid directory string. To organize files like this example, `https://.blob.core.windows.net//json_logs/daily//dt=2020-02-06/hr=09/`, use the properties, `topics.dir=json_logs/daily` and `time.interval=HOURLY`. - **Locale**: Sets the locale to use with `TimeBasedPartitioner`. This is used to format dates and times. For example, you can use `en_US` for English (USA), `en_GB` for English (UK), `en_IN` for English (India), or `fr-FR` for French (France). Defaults to `en`. For a list of locale IDs, see [Java locales](https://www.localeplanet.com/java/?session_ref=direct&url_ref=https%3A%2F%2Fdocs.confluent.io%2Fcloud%2Fcurrent%2Fconnectors%2Fcc-azure-datalakeGen2-storage-sink.html). - **Timezone**: Sets the timezone used by the `TimeBasedPartitioner`. Use a [valid timezone](https://docs.oracle.com/middleware/12212/wcs/tag-ref/MISC/TimeZones.html?session_ref=direct&url_ref=https%3A%2F%2Fdocs.confluent.io%2Fcloud%2Fcurrent%2Fconnectors%2Fcc-azure-datalakeGen2-storage-sink.html). Defaults to `UTC` if not used. - **Timestamp field name**: Sets the field that contains the timestamp used for the `TimeBasedPartitioner`. Defaults to the timestamp when the Kafka record was produced or stored by the Kafka broker. - **Time interval**: Enter the **Time interval** that sets how you want your messages grouped in the bucket. For example, if you select `HOURLY`, messages are grouped into folders for each hour data is streamed to the bucket. **Data decryption** - Enable **Client-Side Field Level Encryption** for data decryption. Specify a **Service Account** to access the Schema Registry and associated encryption rules or keys with that schema. Select the connector behavior (`ERROR` or `NONE`) on data decryption failure. If set to `ERROR`, the connector fails and writes the encrypted data in the DLQ. If set to `NONE`, the connector writes the encrypted data in the target system without decryption. For more information on CSFLE or CSPE setup, see [Manage encryption for connectors](csfle.md#connect-csfle). ### **Show advanced configurations** - **Schema context**: Select a schema context to use for this connector, if using a schema-based data format. This property defaults to the **Default** context, which configures the connector to use the default schema set up for Schema Registry in your Confluent Cloud environment. A schema context allows you to use separate schemas (like schema sub-registries) tied to topics in different Kafka clusters that share the same Schema Registry environment. For example, if you select a non-default context, a **Source** connector uses only that schema context to register a schema and a **Sink** connector uses only that schema context to read from. For more information about setting up a schema context, see [What are schema contexts and when should you use them?](../sr/faqs-cc.md#faq-schema-contexts). - **Parquet Compression Codec**: Compression type for parquet files written to Azure. You can select either `none`, `gzip`, or `snappy`. - **Maximum span of record time (in ms) before scheduled rotation**: Scheduled rotation uses `rotate.schedule.interval.ms` to close the file and upload to storage on regular basis using the current time, rather than the record time. Setting `rotate.schedule.interval.ms` is nondeterministic and will invalidate exactly once guarantees. Minimum value is 60000 ms (10 minutes). - **Maximum span of record time (in ms) before rotation**: Specify the maximum time span (in milliseconds) that a file can remain open for additional records. When using `rotate.interval.ms`, the time span interval for the file starts with the timestamp of the first record added to the file. The connector closes and uploads the file to storage when the timestamp of a subsequent record falls outside the time span set by the first file’s timestamp. The minimum value is 600000 ms (10 minutes). See [Scheduled Rotation](#az-datalake-storage-scheduled-rotation) for details about **Scheduled rotation** properties. **Additional Configs** - **Value Converter Replace Null With Default**: Specifies whether to replace fields that have a default value and that are null to the default value. When set to `true`, the connector uses the default value; otherwise, it uses `null`. Applies to the `JSON` converter. - **Value Converter Schema ID Deserializer**: Sets the class name of the schema ID deserializer for values. The deserializer reads schema IDs from message headers. - **Value Converter Reference Subject Name Strategy**: Sets the subject reference name strategy for values. Valid entries are `DefaultReferenceSubjectNameStrategy` or `QualifiedReferenceSubjectNameStrategy`. You can use this strategy only with `PROTOBUF` format; the default strategy is `DefaultReferenceSubjectNameStrategy`. - **Schema ID For Value Converter**: Sets the schema ID to use for deserialization when using `ConfigSchemaIdDeserializer`. This lets you specify a fixed schema ID for deserializing message values. This property is applicable only when `value.converter.value.schema.id.deserializer` is set to `ConfigSchemaIdDeserializer`. - **Value Converter Schemas Enable**: Includes schema within each of the serialized values. Input messages must contain `schema` and `payload` fields and must not contain additional fields. For plain `JSON` data, set this to `false`. Applies to the `JSON` converter. - **Errors Tolerance**: Use this property to configure the connector’s error handling behavior. #### WARNING Use this property with caution for sink connectors, as it can lead to data loss. If you set this property to `all`, the connector does not fail on errant records, but logs them (and sends to DLQ for sink connectors) and continues processing. If you set this property to `none`, the connector task fails on errant records. - **Value Converter Ignore Default For Nullables**: When set to `true`, this property ensures that the corresponding record in Kafka is `null`, instead of showing the default column value. Applies to the `AVRO`, `PROTOBUF`, and `JSON_SR` converters. - **Key Converter Schema ID Deserializer**: Sets the class name of the schema ID deserializer for keys. The deserializer reads schema IDs from message headers. - **Value Converter Decimal Format**: Specifies the `JSON` or `JSON_SR` serialization format for Connect `DECIMAL` logical type values with two allowed literals: `BASE64` to serialize `DECIMAL` logical types as base64 encoded binary data, and `NUMERIC` to serialize `DECIMAL` logical type values in `JSON` or `JSON_SR` as a number representing the decimal value. - **Schema GUID For Key Converter**: Sets the schema GUID to use for deserialization when using `ConfigSchemaIdDeserializer`. This lets you specify a fixed schema GUID for deserializing message keys. This property is applicable only when `key.converter.key.schema.id.deserializer` is set to `ConfigSchemaIdDeserializer`. - **Schema GUID For Value Converter**: Sets the schema GUID to use for deserialization when using `ConfigSchemaIdDeserializer`. This lets you specify a fixed schema GUID for deserializing message values. This property is applicable only when `value.converter.value.schema.id.deserializer` is set to `ConfigSchemaIdDeserializer`. - **Value Converter Connect Meta Data**: Enables the Connect converter to add its metadata to the output schema. Applies to Avro converters. - **Value Converter Value Subject Name Strategy**: Determines how to construct the subject name under which the value schema is registered with Schema Registry. - **Key Converter Key Subject Name Strategy**: Determines how to construct the subject name for key schema registration. - **Schema ID For Key Converter**: Sets the schema ID to use for deserialization when using `ConfigSchemaIdDeserializer`. This lets you specify a fixed schema ID for deserializing message keys. This property is applicable only when `key.converter.key.schema.id.deserializer` is set to `ConfigSchemaIdDeserializer`. **Auto-restart policy** - **Enable Connector Auto-restart**: Enables the auto-restart behavior of the connector and its task in the event of user-actionable errors. Defaults to `true`, enabling the connector to automatically restart in case of user-actionable errors. Set this property to `false` to disable auto-restart for failed connectors. If disabled, you must manually restart the connector. **Consumer configuration** - **Max poll interval(ms)**: Sets the maximum delay between subsequent consume requests to Kafka. Use this property to improve connector performance in cases when the connector cannot send records to the sink system. The default is 300,000 milliseconds (5 minutes). - **Max poll records**: Sets the maximum number of records to consume from Kafka in a single request. Use this property to improve connector performance in cases when the connector cannot send records to the sink system. The default is 500 records. **Transforms** - **Single Message Transformations**: To add a new SMT, see [Add transforms](single-message-transforms.md#cc-single-message-transforms-ui). For more information about unsupported SMTs, see [Unsupported transformations](single-message-transforms.md#cc-single-message-transforms-unsupported-transforms). **Processing position** - **Set offsets**: Click **Set offsets** to define a specific offset for this connector to begin procession data from. For more information on managing offsets, see [Manage offsets](offsets.md#connect-custom-offsets). - Click **Continue**. ### Sizing Based on the number of topic partitions you select, you will be provided with a recommended number of tasks. 1. To change the number of recommended tasks, enter the number of [tasks](/platform/current/connect/concepts.html#tasks) for the connector to use in the **Tasks** field. 2. Click **Continue**. ### Review and Launch 1. Verify the connection details. 2. Click **Launch**.  The status for the connector should go from **Provisioning** to **Running**. #### Step 5: Check the Azure storage container 1. From the Azure portal, go to your Azure storage account. 2. Open each folder until you see your messages displayed.  For more information and examples to use with the Confluent Cloud API for Connect, see the [Confluent Cloud API for Connect Usage Examples](connect-api-section.md#ccloud-connect-api) section. ### Using the Confluent CLI Complete the following steps to set up and run the connector using the Confluent CLI. #### NOTE Make sure you have all your [prerequisites](#cc-datalake-gen2-sink-prereqs) completed. #### Step 1: List the available connectors Enter the following command to list available connectors: ```none confluent connect plugin list ``` #### Step 2: List the connector configuration properties Enter the following command to show the connector configuration properties: ```none confluent connect plugin describe ``` The command output shows the required and optional configuration properties. #### Step 3: Create the connector configuration file Create a JSON file that contains the connector configuration properties. The following examples show the required connector properties for both partitioner types. **Example configuration for TimeBasedPartitioner:** ```none { "name": "adls-sink-connector", "connector.class": "AzureDataLakeGen2Sink", "kafka.auth.mode": "KAFKA_API_KEY", "kafka.api.key": "", "kafka.api.secret": "", "topics": "pageviews", "input.data.format": "AVRO", "azure.datalake.gen2.account.name": "", "azure.datalake.gen2.access.key": "", "topics.dir": "topics", "output.data.format": "AVRO", "partitioner.class": "TimeBasedPartitioner", "time.interval": "HOURLY", "flush.size": "1000", "tasks.max": "1" } ``` **Example configuration for DefaultPartitioner:** ```none { "name": "adls-sink-connector", "connector.class": "AzureDataLakeGen2Sink", "kafka.auth.mode": "KAFKA_API_KEY", "kafka.api.key": "", "kafka.api.secret": "", "topics": "pageviews", "input.data.format": "AVRO", "azure.datalake.gen2.account.name": "", "azure.datalake.gen2.access.key": "", "topics.dir": "topics", "output.data.format": "AVRO", "partitioner.class": "DefaultPartitioner", "flush.size": "1000", "tasks.max": "1" } ``` Note the following property definitions: * `"name"`: Sets a name for your new connector. * `"connector.class"`: Identifies the connector plugin name. * `"kafka.auth.mode"`: Identifies the connector authentication mode you want to use. There are two options: `SERVICE_ACCOUNT` or `KAFKA_API_KEY` (the default). To use an API key and secret, specify the configuration properties `kafka.api.key` and `kafka.api.secret`, as shown in the example configuration (above). To use a [service account](service-account.md#s3-cloud-service-account), specify the **Resource ID** in the property `kafka.service.account.id=`. To list the available service account resource IDs, use the following command: ```bash confluent iam service-account list ``` For example: ```bash confluent iam service-account list Id | Resource ID | Name | Description +---------+-------------+-------------------+------------------- 123456 | sa-l1r23m | sa-1 | Service account 1 789101 | sa-l4d56p | sa-2 | Service account 2 ``` * The configuration example above shows basic Azure authentication properties. For Active Directory (AD) authentication details, see [Azure Storage Authentication](#cc-azure-datalakegen2storage-sink-auth). For the configuration properties to use, see [Configuration Properties](#cc-azure-datalakegen2-sink-config-properties). * `"topics"`: Identifies the topic name or a comma-separated list of topic names. * `"input.data.format"`: Sets the input Kafka record value format. Valid entries are **AVRO**, **JSON_SR**, **PROTOBUF**, **JSON**, or **BYTES**. You must have Confluent Cloud Schema Registry configured if using a schema-based message format (for example, Avro, JSON_SR (JSON Schema), or Protobuf). #### NOTE Input format JSON to output format AVRO does not work for the connector. * `"topics.dir"`: The example above shows the default entry `topics`. In this example, the directory hierarchy created is `topics/pageviews`. Each Kafka topic will have a separate subdirectory based on the Kafka topic name. `topics.dir` shouldn’t start with `/`. * `"output.data.format"`: Sets the output Kafka record value format (data coming from the connector). Valid entries are **AVRO**, **PARQUET**, **JSON**, or **BYTES**. You must have Confluent Cloud Schema Registry configured if using a schema-based output format (for example, Avro). * `"partitioner.class"`: Sets the partitioner class to use. Valid entries are: * `"TimeBasedPartitioner"` (default) * `"DefaultPartitioner"` * (Optional) `flush.size`: Defaults to 1000. The value can be increased if needed. The value can be lowered (1 minimum) if you are running a [Dedicated Confluent Cloud cluster](../clusters/cluster-types.md#dedicated-cluster). The minimum value is 1000 for non-dedicated clusters. The following scenarios describe a couple of ways records may be flushed to storage: * You use the default setting of 1000 and your topic has six partitions. Files start to be created in storage after more than 1000 records exist in each partition. * You use the default setting of 1000 and the partitioner is set to Hourly. 500 records arrive at one partition from 2:00pm to 3:00pm. At 3:00pm, an additional 5 records arrive at the partition. You will see 500 records in storage at 3:00pm. #### NOTE The properties `rotate.schedule.interval.ms` and `rotate.interval.ms` can be used with `flush.size` to determine when files are created in storage. These parameters kick in and files are stored based on which condition is met first. For FieldPartitioner in fully managed connectors, an additional automatic rotation occurs when the number of open files reaches 50. This uploads the current batch of files to storage and creates a new batch. For example: You have one topic partition. You set `flush.size=1000` and `rotate.schedule.interval.ms=600000` (10 minutes). 500 records arrive at the topic partition from 12:01 to 12:10. 500 additional records arrive from 12:11 to 12:20. You will see two files in the storage bucket with 500 records in each file. This is because the 10 minute `rotate.schedule.interval.ms` condition tripped before the `flush.size=1000` condition was met. * `"time.interval"`: (TimeBasedPartitioner only) Sets how your messages are grouped in the Azure Data Lake Storage Gen2 container. Valid entries are **DAILY** or **HOURLY**. * `"topics.dir"`: A top-level directory path to use for stored data. Defaults to `topics` if not used. * `"path.format"`:(TimeBasedPartitioner only) Configures the time-based partitioning path created. The property converts the UNIX timestamp to a date format string. If not used, this property defaults to `'year'=YYYY/'month'=MM/'day'=dd/'hour'=HH` if an Hourly `time.interval` was selected or `'year'=YYYY/'month'=MM/'day'=dd` if a Daily Time interval was selected. * `rotate.schedule.interval.ms` and `rotate.interval.ms`: See [Scheduled Rotation](#az-datalake-storage-scheduled-rotation) for details about using these properties. * `"tasks.max"`: Enter the maximum number of connector tasks to use. #### NOTE To enable CSFLE or CSPE for data encryption, specify the following properties: * `csfle.enabled`: Flag to indicate whether the connector honors CSFLE or CSPE rules. * `sr.service.account.id`: A Service Account to access the Schema Registry and associated encryption rules or keys with that schema. * `csfle.onFailure`: Configures the connector behavior (`ERROR` or `NONE`) on data decryption failure. If set to `ERROR`, the connector fails and writes the encrypted data in the DLQ. If set to `NONE`, the connector writes the encrypted data in the target system without decryption. When using CSFLE or CSPE with connectors that route failed messages to a Dead Letter Queue (DLQ), be aware that data sent to the DLQ is written in unencrypted plaintext. This poses a significant security risk as sensitive data that should be encrypted may be exposed in the DLQ. Do not use DLQ with CSFLE or CSPE in the current version. If you need error handling for CSFLE- or CSPE-enabled data, use alternative approaches such as: * Setting the connector behavior to `ERROR` to throw exceptions instead of routing to DLQ * Implementing custom error handling in your applications * Using `NONE` to pass encrypted data through without decryption For more information on CSFLE or CSPE setup, see [Manage encryption for connectors](csfle.md#connect-csfle). **SMTs**: For details about adding SMTs using the Confluent CLI, see the [Single Message Transformations](single-message-transforms.md#cc-single-message-transforms) documentation. For a list of SMTs that are not supported with this connector, see [Unsupported transformations](single-message-transforms.md#cc-single-message-transforms-unsupported-transforms). See [Configuration Properties](#cc-azure-datalakegen2-sink-config-properties) for all property values and definitions. #### Step 4: Load the properties file and create the connector Enter the following command to load the configuration and start the connector: ```none confluent connect cluster create --config-file .json ``` For example: ```none confluent connect cluster create --config-file adls-sink-config.json ``` Example output: ```none Created connector adls-sink-connector lcc-ix4dl ``` #### Step 5: Check the connector status Enter the following command to check the connector status: ```none confluent connect cluster list ``` Example output: ```none ID | Name | Status | Type +-----------+---------------------------+---------+------+ lcc-ix4dl | adls-sink-connector | RUNNING | sink ``` #### Step 6: Check the Azure storage container. 1. From the Azure portal, go to your Azure storage account. 2. Open each folder until you see your messages displayed.  For more information and examples to use with the Confluent Cloud API for Connect, see the [Confluent Cloud API for Connect Usage Examples](connect-api-section.md#ccloud-connect-api) section. ## Scheduled Rotation Two optional properties are available that allow you to set up a rotation schedule. These properties are provided in the Cloud Console (shown below) and in the Confluent CLI.  * `rotate.schedule.interval.ms` (Scheduled rotation): This property allows you to configure a regular schedule for when files are closed and uploaded to storage. The default value is `-1` (disabled). For example, when this is set for 600000 ms, you will see files available in the storage bucket at least every 10 minutes. `rotate.schedule.interval.ms` does not require a continuous stream of data. #### NOTE Using the `rotate.schedule.interval.ms` property results in a non-deterministic environment and invalidates exactly-once guarantees. * `rotate.interval.ms` (Rotation interval): This property allows you to specify the maximum time span (in milliseconds) that a file can remain open for additional records. When using this property, the time span interval for the file starts with the timestamp of the first record added to the file. The connector closes and uploads the file to storage when the timestamp of a subsequent record falls outside the time span set by the first file’s timestamp. This property defaults to the interval set by the `time.interval` property. `rotate.interval.ms` requires a continuous stream of data. #### IMPORTANT The start and end of the time span interval is determined using file timestamps. For this reason, a file could potentially remain open for a long time if a record does not arrive with a timestamp falling outside the time span set by the first file’s timestamp. ## Configuration Properties Use the following configuration properties with the fully managed connector. For self-managed connector property definitions and other details, see the connector docs in [Self-managed connectors for Confluent Platform](/platform/current/connect/kafka_connectors.html). ### Which topics do you want to get data from? `topics.regex` : A regular expression that matches the names of the topics to consume from. This is useful when you want to consume from multiple topics that match a certain pattern without having to list them all individually.
* Type: string * Importance: low `topics` : Identifies the topic name or a comma-separated list of topic names.
* Type: list * Importance: high `errors.deadletterqueue.topic.name` : The name of the topic to be used as the dead letter queue (DLQ) for messages that result in an error when processed by this sink connector, or its transformations or converters. Defaults to ‘dlq-${connector}’ if not set. The DLQ topic will be created automatically if it does not exist. You can provide `${connector}` in the value to use it as a placeholder for the logical cluster ID.
* Type: string * Default: dlq-${connector} * Importance: low ### Schema Config `schema.context.name` : Add a schema context name. A schema context represents an independent scope in Schema Registry. It is a separate sub-schema tied to topics in different Kafka clusters that share the same Schema Registry instance. If not used, the connector uses the default schema configured for Schema Registry in your Confluent Cloud environment.
* Type: string * Default: default * Importance: medium ### Input messages `input.data.format` : Sets the input message format. Valid entries are AVRO, JSON_SR, PROTOBUF, JSON or BYTES. Note that you need to have Confluent Cloud Schema Registry configured if using a schema-based message format like AVRO, JSON_SR, and PROTOBUF
* Type: string * Default: JSON * Importance: high ### How should we connect to your data? `name` : Sets a name for your connector.
* Type: string * Valid Values: A string at most 64 characters long * Importance: high ### Authentication method `authentication.method` : How Confluent Cloud authenticates with Azure.
* Type: string * Default: “” * Importance: high `secret.manager.enabled` : Fetch sensitive configuration values from a secret manager.
* Type: boolean * Default: false * Importance: high ### Secret manager configuration `secret.manager` : Select the secret manager to use for retrieving sensitive data.
* Type: string * Importance: high `secret.manager.managed.configs` : Select the configurations to fetch their values from the secret manager.
* Type: list * Importance: high `secret.manager.provider.integration.id` : Select an existing provider integration that has access to your secret manager.
* Type: string * Importance: high ### Azure credentials `provider.integration.id` : Azure provider-integration to mint Microsoft Entra ID application tokens.
* Type: string * Importance: high `azure.datalake.gen2.access.key` : Access Key for the storage account.
* Type: password * Importance: high `azure.datalake.gen2.client.id` : The client ID (GUID) of the client obtained from Azure Active Directory configuration.
* Type: string * Importance: high `azure.datalake.gen2.client.key` : The secret key of the client.
* Type: password * Importance: high `azure.datalake.gen2.token.endpoint` : The OAuth 2.0 token endpoint associated with the user’s directory (obtain from Active Directory configuration)
* Type: string * Importance: high ### Kafka Cluster credentials `kafka.auth.mode` : Kafka Authentication mode. It can be one of KAFKA_API_KEY or SERVICE_ACCOUNT. It defaults to KAFKA_API_KEY mode, whenever possible.
* Type: string * Valid Values: SERVICE_ACCOUNT, KAFKA_API_KEY * Importance: high `kafka.api.key` : Kafka API Key. Required when kafka.auth.mode==KAFKA_API_KEY.
* Type: password * Importance: high `kafka.service.account.id` : The Service Account that will be used to generate the API keys to communicate with Kafka Cluster.
* Type: string * Importance: high `kafka.api.secret` : Secret associated with Kafka API key. Required when kafka.auth.mode==KAFKA_API_KEY.
* Type: password * Importance: high ### Destination `azure.datalake.gen2.account.name` : Must be between 3-23 alphanumeric characters.
* Type: string * Importance: high `topics.dir` : The top-level directory where data is written. Do not start the `topics.dir` entry with a forward slash (`/`). This value can be a container name or a path to a directory, for example, `containername/subpath`.
* Type: string * Default: topics * Importance: high ### Output messages `output.data.format` : Set the output message format for values. Valid entries are AVRO, JSON, PARQUET or BYTES. Note that you need to have Confluent Cloud Schema Registry configured if using a schema-based message format like AVRO. Note that the output message format defaults to the value in the Input Message Format field. If either PROTOBUF or JSON_SR is selected as the input message format, you should select one explicitly. If no value for this property is provided, the value specified for the ‘input.data.format’ property is used.
* Type: string * Importance: high `parquet.codec` : Compression type for parquet files written to Azure.
* Type: string * Importance: high ### Organize my data by… `partitioner.class` : The partitioner to use when writing data to the Azure Data Lake Storage container. Supported values are DefaultPartitioner (organizes records by the topic partition) and TimeBasedPartitioner (organizes records by time, e.g., daily or hourly).
* Type: string * Default: TimeBasedPartitioner * Valid Values: DefaultPartitioner, TimeBasedPartitioner * Importance: high `path.format` : This configuration is used to set the format of the data directories when partitioning with TimeBasedPartitioner. The format set in this configuration converts the Unix timestamp to a valid directory string. To organize files like this example, [https:/](https:/)/.blob.core.windows.net//json_logs/daily//dt=2020-02-06/hr=09/, use the properties: topics.dir=json_logs/daily, path.format=’dt’=YYYY-MM-dd/’hr’=HH, and time.interval=HOURLY.
* Type: string * Default: ‘year’=YYYY/’month’=MM/’day’=dd/’hour’=HH * Importance: high `locale` : Sets the locale to use with TimeBasedPartitioner.
* Type: string * Default: en * Importance: high `timezone` : Sets the timezone used by the TimeBasedPartitioner.
* Type: string * Default: UTC * Importance: high `rotate.schedule.interval.ms` : Scheduled rotation uses rotate.schedule.interval.ms to close the file and upload to storage on a regular basis using the current time, rather than the record time. Setting rotate.schedule.interval.ms is nondeterministic and will invalidate exactly-once guarantees.
* Type: int * Default: -1 * Importance: medium `rotate.interval.ms` : The connector’s rotation interval specifies the maximum timespan (in milliseconds) a file can remain open and ready for additional records. In other words, when using rotate.interval.ms, the timestamp for each file starts with the timestamp of the first record inserted in the file. The connector closes and uploads a file to the blob store when the next record’s timestamp does not fit into the file’s rotate.interval time span from the first record’s timestamp. If the connector has no more records to process, the connector may keep the file open until the connector can process another record (which can be a long time). If no value for this property is provided, the value specified for the ‘time.interval’ property is used.
* Type: int * Importance: high `timestamp.field` : Sets the field that contains the timestamp used for the TimeBasedPartitioner
* Type: string * Default: “” * Importance: high `time.interval` : Partitioning interval of data, according to the time ingested to storage.
* Type: string * Valid Values: DAILY, HOURLY * Importance: high `flush.size` : Number of records written to storage before invoking file commits.
* Type: int * Default: 1000 * Valid Values: [1000,…] for non-dedicated clusters and [1,…] for dedicated clusters * Importance: high ### Consumer configuration `max.poll.interval.ms` : The maximum delay between subsequent consume requests to Kafka. This configuration property may be used to improve the performance of the connector, if the connector cannot send records to the sink system. Defaults to 300000 milliseconds (5 minutes).
* Type: long * Default: 300000 (5 minutes) * Valid Values: [60000,…,1800000] for non-dedicated clusters and [60000,…] for dedicated clusters * Importance: low `max.poll.records` : The maximum number of records to consume from Kafka in a single request. This configuration property may be used to improve the performance of the connector, if the connector cannot send records to the sink system. Defaults to 500 records.
* Type: long * Default: 500 * Valid Values: [1,…,500] for non-dedicated clusters and [1,…] for dedicated clusters * Importance: low ### Number of tasks for this connector `tasks.max` : Maximum number of tasks for the connector.
* Type: int * Valid Values: [1,…] * Importance: high ### Additional Configs `consumer.override.auto.offset.reset` : Defines the behavior of the consumer when there is no committed position (which occurs when the group is first initialized) or when an offset is out of range. You can choose either to reset the position to the “earliest” offset (the default) or the “latest” offset. You can also select “none” if you would rather set the initial offset yourself and you are willing to handle out of range errors manually. More details: [https://docs.confluent.io/platform/current/installation/configuration/consumer-configs.html#auto-offset-reset](https://docs.confluent.io/platform/current/installation/configuration/consumer-configs.html#auto-offset-reset)
* Type: string * Importance: low `consumer.override.isolation.level` : Controls how to read messages written transactionally. If set to read_committed, consumer.poll() will only return transactional messages which have been committed. If set to read_uncommitted (the default), consumer.poll() will return all messages, even transactional messages which have been aborted. Non-transactional messages will be returned unconditionally in either mode. More details: [https://docs.confluent.io/platform/current/installation/configuration/consumer-configs.html#isolation-level](https://docs.confluent.io/platform/current/installation/configuration/consumer-configs.html#isolation-level)
* Type: string * Importance: low `header.converter` : The converter class for the headers. This is used to serialize and deserialize the headers of the messages.
* Type: string * Importance: low `key.converter.use.schema.guid` : The schema GUID to use for deserialization when using ConfigSchemaIdDeserializer. This allows you to specify a fixed schema GUID to be used for deserializing message keys. Only applicable when key.converter.key.schema.id.deserializer is set to ConfigSchemaIdDeserializer.
* Type: string * Importance: low `key.converter.use.schema.id` : The schema ID to use for deserialization when using ConfigSchemaIdDeserializer. This allows you to specify a fixed schema ID to be used for deserializing message keys. Only applicable when key.converter.key.schema.id.deserializer is set to ConfigSchemaIdDeserializer.
* Type: int * Importance: low `value.converter.allow.optional.map.keys` : Allow optional string map key when converting from Connect Schema to Avro Schema. Applicable for Avro Converters.
* Type: boolean * Importance: low `value.converter.auto.register.schemas` : Specify if the Serializer should attempt to register the Schema.
* Type: boolean * Importance: low `value.converter.connect.meta.data` : Allow the Connect converter to add its metadata to the output schema. Applicable for Avro Converters.
* Type: boolean * Importance: low `value.converter.enhanced.avro.schema.support` : Enable enhanced schema support to preserve package information and Enums. Applicable for Avro Converters.
* Type: boolean * Importance: low `value.converter.enhanced.protobuf.schema.support` : Enable enhanced schema support to preserve package information. Applicable for Protobuf Converters.
* Type: boolean * Importance: low `value.converter.flatten.unions` : Whether to flatten unions (oneofs). Applicable for Protobuf Converters.
* Type: boolean * Importance: low `value.converter.generate.index.for.unions` : Whether to generate an index suffix for unions. Applicable for Protobuf Converters.
* Type: boolean * Importance: low `value.converter.generate.struct.for.nulls` : Whether to generate a struct variable for null values. Applicable for Protobuf Converters.
* Type: boolean * Importance: low `value.converter.int.for.enums` : Whether to represent enums as integers. Applicable for Protobuf Converters.
* Type: boolean * Importance: low `value.converter.latest.compatibility.strict` : Verify latest subject version is backward compatible when use.latest.version is true.
* Type: boolean * Importance: low `value.converter.object.additional.properties` : Whether to allow additional properties for object schemas. Applicable for JSON_SR Converters.
* Type: boolean * Importance: low `value.converter.optional.for.nullables` : Whether nullable fields should be specified with an optional label. Applicable for Protobuf Converters.
* Type: boolean * Importance: low `value.converter.optional.for.proto2` : Whether proto2 optionals are supported. Applicable for Protobuf Converters.
* Type: boolean * Importance: low `value.converter.scrub.invalid.names` : Whether to scrub invalid names by replacing invalid characters with valid characters. Applicable for Avro and Protobuf Converters.
* Type: boolean * Importance: low `value.converter.use.latest.version` : Use latest version of schema in subject for serialization when auto.register.schemas is false.
* Type: boolean * Importance: low `value.converter.use.optional.for.nonrequired` : Whether to set non-required properties to be optional. Applicable for JSON_SR Converters.
* Type: boolean * Importance: low `value.converter.use.schema.guid` : The schema GUID to use for deserialization when using ConfigSchemaIdDeserializer. This allows you to specify a fixed schema GUID to be used for deserializing message values. Only applicable when value.converter.value.schema.id.deserializer is set to ConfigSchemaIdDeserializer.
* Type: string * Importance: low `value.converter.use.schema.id` : The schema ID to use for deserialization when using ConfigSchemaIdDeserializer. This allows you to specify a fixed schema ID to be used for deserializing message values. Only applicable when value.converter.value.schema.id.deserializer is set to ConfigSchemaIdDeserializer.
* Type: int * Importance: low `value.converter.wrapper.for.nullables` : Whether nullable fields should use primitive wrapper messages. Applicable for Protobuf Converters.
* Type: boolean * Importance: low `value.converter.wrapper.for.raw.primitives` : Whether a wrapper message should be interpreted as a raw primitive at root level. Applicable for Protobuf Converters.
* Type: boolean * Importance: low `errors.tolerance` : Use this property if you would like to configure the connector’s error handling behavior. WARNING: This property should be used with CAUTION for SOURCE CONNECTORS as it may lead to dataloss. If you set this property to ‘all’, the connector will not fail on errant records, but will instead log them (and send to DLQ for Sink Connectors) and continue processing. If you set this property to ‘none’, the connector task will fail on errant records.
* Type: string * Default: all * Importance: low `key.converter.key.schema.id.deserializer` : The class name of the schema ID deserializer for keys. This is used to deserialize schema IDs from the message headers.
* Type: string * Default: io.confluent.kafka.serializers.schema.id.DualSchemaIdDeserializer * Importance: low `key.converter.key.subject.name.strategy` : How to construct the subject name for key schema registration.
* Type: string * Default: TopicNameStrategy * Importance: low `value.converter.decimal.format` : Specify the JSON/JSON_SR serialization format for Connect DECIMAL logical type values with two allowed literals:
BASE64 to serialize DECIMAL logical types as base64 encoded binary data and
NUMERIC to serialize Connect DECIMAL logical type values in JSON/JSON_SR as a number representing the decimal value.
* Type: string * Default: BASE64 * Importance: low `value.converter.flatten.singleton.unions` : Whether to flatten singleton unions. Applicable for Avro and JSON_SR Converters.
* Type: boolean * Default: false * Importance: low `value.converter.ignore.default.for.nullables` : When set to true, this property ensures that the corresponding record in Kafka is NULL, instead of showing the default column value. Applicable for AVRO,PROTOBUF and JSON_SR Converters.
* Type: boolean * Default: false * Importance: low `value.converter.reference.subject.name.strategy` : Set the subject reference name strategy for value. Valid entries are DefaultReferenceSubjectNameStrategy or QualifiedReferenceSubjectNameStrategy. Note that the subject reference name strategy can be selected only for PROTOBUF format with the default strategy being DefaultReferenceSubjectNameStrategy.
* Type: string * Default: DefaultReferenceSubjectNameStrategy * Importance: low `value.converter.replace.null.with.default` : Whether to replace fields that have a default value and that are null to the default value. When set to true, the default value is used, otherwise null is used. Applicable for JSON Converter.
* Type: boolean * Default: true * Importance: low `value.converter.schemas.enable` : Include schemas within each of the serialized values. Input messages must contain schema and payload fields and may not contain additional fields. For plain JSON data, set this to false. Applicable for JSON Converter.
* Type: boolean * Default: false * Importance: low `value.converter.value.schema.id.deserializer` : The class name of the schema ID deserializer for values. This is used to deserialize schema IDs from the message headers.
* Type: string * Default: io.confluent.kafka.serializers.schema.id.DualSchemaIdDeserializer * Importance: low `value.converter.value.subject.name.strategy` : Determines how to construct the subject name under which the value schema is registered with Schema Registry.
* Type: string * Default: TopicNameStrategy * Importance: low ### Auto-restart policy `auto.restart.on.user.error` : Enable connector to automatically restart on user-actionable errors.
* Type: boolean * Default: true * Importance: medium ## Frequently asked questions Find answers to frequently asked questions about the fully managed Azure Data Lake Storage Gen2 Sink connector for Confluent Cloud. ### Why do I get `This request is not authorized to perform this operation` error? When configuring the connector over an Egress Private Link connection to Azure destinations, you must set the Egress PrivateLink Endpoint to **DFS**, not **blob**. The default setting of blob will not allow for private connectivity and will result in a 403 authorization error. To resolve this issue: 1. Navigate to your Egress Private Link Endpoint configuration. 2. Set the **Target System** to **Data Lake Storage Gen2**. 3. Set the **Sub-resource Name** to **dfs**. ### Why do I get `Could not write file. Possibly mismatched read/write/network permissions.` error? This error typically indicates one of the following issues: * **Insufficient permissions**: Verify that the service principal or account has the **Storage Blob Data Contributor** role assigned. Custom Azure RBAC IAM roles are not supported. * **Network restrictions**: Check that the Azure storage account’s network settings allow connectivity from your Confluent Cloud cluster. If using IP allowlists, ensure all required IP addresses are permitted. * **Incorrect credentials**: Verify that the `Client ID`, `Client Key`, and `Token Endpoint` are correctly configured for Active Directory authentication, or that the account name and access key are correct for basic authentication. * **Container existence**: Ensure the target container exists in your Azure Data Lake Storage Gen2 account before starting the connector. The connector cannot automatically create containers. ### How can I partition records by custom timestamps? The connector supports partitioning records based on a custom timestamp field within the record payload. While the connector defaults to using the Kafka record timestamp (`CreateTime` or `LogAppendTime`), you can override this behavior. To partition records by a field within your message (such as `source_ts_ms` or `transaction_timestamp`), configure the following settings: * **Partitioner class**: Set this to `TimeBasedPartitioner`. * **Timestamp field**: Enter the name of the field in your record payload that contains the timestamp. ### Why is my connector creating many small files? File rotation can be triggered by multiple conditions. The connector commits and uploads files when any of these conditions are met: * **Record count**: The number of records reaches `flush.size`. * **Schema change**: A new schema version is detected when using schema-based formats like Avro or Parquet. * **Time-based rotation**: The time interval specified in `rotate.schedule.interval.ms` or `rotate.interval.ms` elapses. * **Partition boundary**: The time-based partition boundary is reached when using `TimeBasedPartitioner` with `time.interval` set to `HOURLY` or `DAILY`. To reduce the number of small files: 1. Increase `flush.size`. 2. Adjust `rotate.schedule.interval.ms` to a longer interval. 3. For Parquet and Avro formats, ensure your schema is stable to avoid frequent rotations due to schema evolution. 4. Review your `time.interval` setting if using `TimeBasedPartitioner`. ### Can I configure the minimum flush size to less than 1000 records? The minimum `flush.size` depends on your cluster type: * **Dedicated clusters**: Minimum of one record. * **Non-dedicated clusters** (Basic, Standard): Minimum of 1000 records. If you are using a non-dedicated cluster and require more granular file rotation, consider upgrading to a dedicated cluster or using time-based rotation properties like `rotate.schedule.interval.ms` or `rotate.interval.ms` instead. ### Why are all my messages going to the Dead Letter Queue (DLQ)? Messages are routed to the DLQ when the connector encounters errors processing them. Common causes include: * **Schema mismatch**: The record schema does not match what the connector expects. Verify that your `input.data.format` matches the actual data format in your topic. * **Serialization errors**: Records cannot be deserialized properly. This often occurs when: * Confluent Cloud Schema Registry is not configured, but schema-based formats like Avro, Protobuf, JSON_SR are used. * Mixing schemaless JSON with schema-based formats. * Schema evolution introduces incompatible changes. * **Invalid data**: The record contains data that violates schema constraints or cannot be converted to the output format. To troubleshoot: 1. Check the connector logs for specific error messages. 2. Verify that [Schema Registry](../get-started/schema-registry.md#cloud-sr-config) is enabled and configured if using Avro, JSON_SR, or Protobuf. 3. Ensure all messages in the topic conform to the expected schema and format. 4. Review `dlq-` to examine the failed messages. ### Can I use the connector with WORM-enabled (immutable) Azure containers? Yes, the connector supports Write Once, Read Many (WORM)-enabled Azure Data Lake Storage Gen2 containers with the following requirements: * The immutability policies must enable the `AllowProtectedAppendWritesAll` property. * The connector only supports **at-least-once** delivery semantics when WORM is enabled (not exactly-once). To configure WORM support: 1. Enable immutability policies on your Azure container with append writes allowed. See [Allow protected append blob writes](https://learn.microsoft.com/en-us/azure/storage/blobs/immutable-container-level-worm-policies#allow-protected-append-blobs-writes). 2. Configure the connector as usual. The connector will automatically use append operations compatible with WORM policies. #### NOTE When WORM is **not** enabled, the connector can provide exactly-once delivery semantics. ### How can I improve my connector throughput? You can improve the connector’s throughput by optimizing the following configurations: * **Increase the number of tasks**: Set `tasks.max` to match or exceed the number of partitions in your topics. Each task can process one partition independently. * **Review partition distribution**: Check if your topic has partition imbalance. If one partition has significantly more data than others, rebalance your data or adjust your partitioning strategy. * **Optimize flush.size**: Larger `flush.size` values reduce the number of files created and can improve throughput, but increase latency before data is visible in Azure storage. * **Check network connectivity**: Ensure there are no network latency issues between your Confluent Cloud cluster and Azure storage, especially if they are in different regions. * **Monitor Azure storage throttling**: Azure may throttle requests if you exceed storage account limits. Check Azure metrics for throttling indicators. * **Adjust rotation intervals**: If using time-based rotation, ensure `rotate.schedule.interval.ms` or `rotate.interval.ms` values are appropriate for your data volume. ### Can the connector automatically create the Azure container if it doesn’t exist? No, the connector cannot automatically create containers in Azure Data Lake Storage Gen2. You must create the target container before starting the connector. Attempting to start the connector without an existing container will result in errors. ## Next Steps For an example that shows fully managed Confluent Cloud connectors in action with Confluent Cloud for Apache Flink, see the [Cloud ETL Demo](/platform/current/tutorials/examples/cloud-etl/docs/index.html). This example also shows how to use Confluent CLI to manage your resources in Confluent Cloud. [](https://docs.confluent.io/platform/current/tutorials/examples/cloud-etl/docs/index.html)