Elasticsearch Service Sink Connector for Confluent Cloud

The fully-managed Elasticsearch Service Sink connector for Confluent Cloud moves data from Apache Kafka® to Elasticsearch. The connector supports Avro, JSON Schema, Protobuf, or JSON (schemaless) data output from Apache Kafka® topics. It writes data from a topic in Kafka to an Elasticsearch index. Elasticsearch is often used for text queries, analytics, and as a key-value store.

The connector supports both the analytics and key-value store use cases. For the analytics use case, each message in Kafka is treated as an event and the connector uses topic+partition+offset as a unique identifier for events, which are then converted to unique documents in Elasticsearch.

For the key-value store use case, the connector supports using keys from Kafka messages as document IDs in Elasticsearch, while providing configurations that ensure updates to a key are written to Elasticsearch in order. For both use cases, Elasticsearch’s idempotent write semantics guarantees exactly once delivery.

All data for a topic have the same type in Elasticsearch. This allows an independent evolution of schemas for data from different topics. This simplifies schema evolution because Elasticsearch has one enforcement on mappings; that is, all fields with the same name in the same index must have the same mapping type. By default, index in Elasticsearch is named same as the topic name.

Note

This is a Quick Start for the fully-managed cloud connector. If you are installing the connector locally for Confluent Platform, see Elasticsearch Service Sink connector for Confluent Platform.

Features

The Elasticsearch Service Sink connector inserts Kafka records into an Elasticsearch index (it supports inserts only).

The connector provides the following features:

• Database authentication: Uses Username and password authentication.
• Input data formats: The connector supports Avro, JSON Schema, Protobuf, or JSON (schemaless) input data formats. Schema Registry must be enabled to use a Schema Registry-based format (for example, Avro, JSON_SR (JSON Schema), or Protobuf). See Schema Registry Enabled Environments for additional information.
• Select configuration properties: Provides several optional configuration properties that allow you to fine-tune the connector’s behavior and performance. These properties are described below:
  • key.ignore: Whether to ignore the record key for the purpose of forming the Elasticsearch document ID. When this is set to true, document IDs are created from the topic name, partition, and offset (i.e., topic+partition+offset).
  • schema.ignore: Whether to ignore schemas during indexing. When this property is set to true, the record schema is ignored and Elasticsearch infers the mapping from the data. For this to work, Elasticsearch dynamic mapping must be enabled. Note that this property must stay set to false (default) for JSON (schemaless).
  • compact.map.entries: Defines how map entries with string keys in record values should be written to JSON. When this property is set to true, the entries are written compactly as `"entryKey": "entryValue". Otherwise, map entries with string keys are written as a nested document ({"key": "entryKey", "value": "entryValue"}).
  • behavior.on.null.values: How to handle records with a non-null key and a null value (i.e., Kafka tombstone records). Valid options are ignore, delete, and fail. Defaults to ignore.
  • drop.invalid.message: Whether to drop a Kafka message when it cannot be converted to an output message. Defaults to false.
  • batch.size: The number of records to process as a batch when writing to Elasticsearch. This value defaults to 2000.
  • linger.ms: Linger time in milliseconds for batching. Records that arrive in between request transmissions are batched into a single bulk indexing request, based on the batch.size configuration. Normally this only occurs under load, when records arrive faster than they can be sent out. However, you may want to reduce the number of requests under light load to get the benefits from bulk indexing. In other words, when a pending batch is not full, rather than immediately sending it out the task waits up to the given delay. This allows other records to be added so that they can be batched into a single request. This value defaults to 1000 ms (1 second).
  • flush.timeout.ms The timeout in milliseconds to use for periodic flushing and waiting for buffer space to be made available by completed requests, as records are added. If this timeout is exceeded the task fails. This value defaults to 10000 ms.
  • connection.compression: Whether to use Gzip compression on the HTTP connection to ElasticSearch. To make this setting work the http.compression setting must be set to true on the Elasticsearch nodes. For more information about the Elasticsearch HTTP properties, see Elasticsearch HTTP Settings. Defaults to false.

For more information and examples to use with the Confluent Cloud API for Connect, see the Confluent Cloud API for Managed and Custom Connectors section.

Limitations

Be sure to review the following information.

• For connector limitations, see Elasticsearch Service Sink Connector limitations.
• If you plan to use one or more Single Message Transforms (SMTs), see SMT Limitations.
• If you plan to use Confluent Cloud Schema Registry, see Schema Registry Enabled Environments.

Quick Start

Use this quick start to get up and running with the Confluent Cloud Elasticsearch Service Sink connector. The quick start provides the basics of selecting the connector and configuring it to stream events to an Elasticsearch deployment.

Note

The connector only works with the Elasticsearch Service from Elastic Cloud.

Prerequisites

• Authorized access to a Confluent Cloud cluster on Amazon Web Services (AWS), Microsoft Azure (Azure), or Google Cloud.

• The Confluent CLI installed and configured for the cluster. See Install the Confluent CLI.

• Schema Registry must be enabled to use a Schema Registry-based format (for example, Avro, JSON_SR (JSON Schema), or Protobuf). See Schema Registry Enabled Environments for additional information.

• For networking considerations, see Networking and DNS. To use a set of public egress IP addresses, see Public Egress IP Addresses for Confluent Cloud Connectors.

• The Elasticsearch Service deployment must be in the same region as your Confluent Cloud deployment.

• You add a valid Elasticsearch Service username and password to the connector configuration. You get these when you create your Elastic deployment. An example is shown below:

  

• The Elasticsearch Service Sink connector (user) must have the following privileges:

  • Cluster privileges: monitor, manage, and all
  • Index privileges: create_index, read, write, and view_index_metadata

• Kafka cluster credentials. The following lists the different ways you can provide credentials.
  • Enter an existing service account resource ID.
  • Create a Confluent Cloud service account for the connector. Make sure to review the ACL entries required in the service account documentation. Some connectors have specific ACL requirements.
  • Create a Confluent Cloud API key and secret. To create a key and secret, you can use confluent api-key create or you can autogenerate the API key and secret directly in the Cloud Console when setting up the connector.

Using the Confluent Cloud Console

Step 1: Launch your Confluent Cloud cluster

See the Quick Start for Confluent Cloud for installation instructions.

Step 2: Add a connector

In the left navigation menu, click Connectors. If you already have connectors in your cluster, click + Add connector.

Step 3: Select your connector

Click the Elasticsearch Service Sink connector card.

Step 4: Enter the connector details

Note

• Ensure you have all your prerequisites completed.
• An asterisk ( * ) designates a required entry.

At the Add Elasticsearch Service Sink Connector screen, complete the following:

Select topicKafka credentialsAuthenticationConfigurationSizingReview and Launch

If you’ve already populated your Kafka topics, select the topics you want to connect from the Topics list.

To create a new topic, click +Add new topic.

Step 5: Check the results in Elasticsearch

Verify that new records are being added to your Elasticsearch deployment.

For more information and examples to use with the Confluent Cloud API for Connect, see the Confluent Cloud API for Managed and Custom Connectors section.

Tip

When you launch a connector, a Dead Letter Queue topic is automatically created. See Confluent Cloud Dead Letter Queue for details.

Using the Confluent CLI

Complete the following steps to set up and run the connector using the Confluent CLI.

Note

Make sure you have all your prerequisites completed.

Step 1: List the available connectors

Enter the following command to list available connectors:

confluent connect plugin list

Step 2: List the connector configuration properties

Enter the following command to show the connector configuration properties:

confluent connect plugin describe <connector-plugin-name>

The command output shows the required and optional configuration properties.

Step 3: Create the connector configuration file

Create a JSON file that contains the connector configuration properties. The following example shows required and optional connector properties.

{
  "connector.class": "ElasticsearchSink",
  "name": "elasticsearch-connector",
  "kafka.auth.mode": "KAFKA_API_KEY",
  "kafka.api.key": "<my-kafka-api-key",
  "kafka.api.secret": "<my-kafka-api-secret",
  "topics":  "<topic1>, <topic2>"
  "input.data.format": "JSON",
  "connection.url": "<elasticsearch-URI>",
  "connection.username": "<elasticsearch-username>",
  "connection.password": "<elasticsearch-password>",
  "type.name": "<type-name>",
  "key.ignore": "true",
  "schema.ignore": "true",
  "tasks.max": "1"
}

Note the following property definitions:

• "connector.class": Identifies the connector plugin name.
• "name": Sets a name for your new connector.

• "kafka.auth.mode": Identifies the connector authentication mode you want to use. There are two options: SERVICE_ACCOUNT or KAFKA_API_KEY (the default). To use an API key and secret, specify the configuration properties kafka.api.key and kafka.api.secret, as shown in the example configuration (above). To use a service account, specify the Resource ID in the property kafka.service.account.id=<service-account-resource-ID>. To list the available service account resource IDs, use the following command:

  confluent iam service-account list
  

  For example:

  confluent iam service-account list
  
     Id     | Resource ID |       Name        |    Description
  +---------+-------------+-------------------+-------------------
     123456 | sa-l1r23m   | sa-1              | Service account 1
     789101 | sa-l4d56p   | sa-2              | Service account 2
  

• "input.data.format": Sets the input Kafka record value format (data coming from the Kafka topic). Valid entries are AVRO, JSON_SR, PROTOBUF, or JSON. You must have Confluent Cloud Schema Registry configured if using a schema-based message format (for example, Avro, JSON_SR (JSON Schema), or Protobuf).

• "connection.url": Enter the connection URI. This is the Elasticsearch endpoint you can copy from your Elasticsearch deployment console. The URI you enter should look like this: https://ec5bfac80bc14c26a77eefb6585f196c.us-west-2.aws.found.io:9243.

• "connection.username" and "connection.password" Enter the Elasticsearch deployment username and password. An example showing where these are on the Elastic deployment console is shown in the prerequisites.

• "type.name": This is a name that Elasticsearch uses when indexing and to divide documents into logical groups. This can be anything you choose (for example, customer or item). For more information about this property and mapping in general, see Elasticsearch Mapping: The Basics, Updates & Examples.

The following are optional properties you can include in the configuration:

• key.ignore: Whether to ignore the record key for the purpose of forming the Elasticsearch document ID. When this is set to true, document IDs are created from the topic name, partition, and offset (i.e., topic+partition+offset). Defaults to false if not used.
• schema.ignore: Whether to ignore schemas during indexing. When this property is set to true, the record schema is ignored and Elasticsearch infers the mapping from the data. For this to work, Elasticsearch dynamic mapping must be enabled. Note that this property must stay set to false (default) for JSON. Defaults to false if not used.
• compact.map.entries: Defines how map entries with string keys in record values should be written to JSON. When this property is set to true, the entries are written compactly as `"entryKey": "entryValue". Otherwise, map entries with string keys are written as a nested document ({"key": "entryKey", "value": "entryValue"}). Defaults to false if not used.
• behavior.on.null.values: How to handle records with a non-null key and a null value (i.e., Kafka tombstone records). Valid options are ignore, delete, and fail. Defaults to ignore if not used.
• drop.invalid.message: Whether to drop a Kafka message when it cannot be converted to an output message. Defaults to false if not used.
• batch.size: The number of records to process as a batch when writing to Elasticsearch. This value defaults to 2000 if not used.
• linger.ms: Linger time in milliseconds for batching. Records that arrive in between request transmissions are batched into a single bulk indexing request, based on the batch.size configuration. Normally this only occurs under load, when records arrive faster than they can be sent out. However, you may want to reduce the number of requests under light load, to get the benefits from bulk indexing. In other words, when a pending batch is not full, rather than immediately sending it out the task waits up to the given delay. This allows other records to be added so that they can be batched into a single request. This value defaults to 1000 ms (1 second) if not used.
• flush.timeout.ms The timeout in milliseconds to use for periodic flushing and waiting for buffer space to be made available by completed requests, as records are added. If this timeout is exceeded the task fails. This value defaults to 10000 ms.
• connection.compression: Whether to use Gzip compression on the HTTP connection to ElasticSearch. To make this setting work the http.compression setting must be set to true on the Elasticsearch nodes. For more information about the Elasticsearch HTTP properties, see Elasticsearch HTTP Settings. Defaults to false if not used.

Single Message Transforms: See the Single Message Transforms (SMT) documentation for details about adding SMTs using the CLI. See Unsupported transformations for a list of SMTs that are not supported with this connector.

See Configuration Properties for all property values and definitions.

Step 4: Load the configuration file and create the connector

Enter the following command to load the configuration and start the connector:

confluent connect cluster create --config-file <file-name>.json

For example:

confluent connect cluster create --config-file elasticsearch-sink-config.json

Example output:

Created connector elasticsearch-connector lcc-ix4dl

Step 5: Check the connector status

Enter the following command to check the connector status:

confluent connect cluster list

Example output:

ID          |       Name                 | Status  | Type
+-----------+----------------------------+---------+------+
lcc-ix4dl   | elasticsearch-connector    | RUNNING | sink

Step 6: Check the results in Elasticsearch.

Verify that new records are being added to the Elasticsearch deployment.

For more information and examples to use with the Confluent Cloud API for Connect, see the Confluent Cloud API for Managed and Custom Connectors section.

Tip

When you launch a connector, a Dead Letter Queue topic is automatically created. See Confluent Cloud Dead Letter Queue for details.

Configuration Properties

Use the following configuration properties with the fully-managed connector. For self-managed connector property definitions and other details, see the connector docs in Self-managed connectors for Confluent Platform.

Which topics do you want to get data from?

topics

Identifies the topic name or a comma-separated list of topic names.

• Type: list
• Importance: high

Schema Config

schema.context.name

Add a schema context name. A schema context represents an independent scope in Schema Registry. It is a separate sub-schema tied to topics in different Kafka clusters that share the same Schema Registry instance. If not used, the connector uses the default schema configured for Schema Registry in your Confluent Cloud environment.

• Type: string
• Default: default
• Importance: medium

Input messages

input.data.format

Sets the input Kafka record value format. Valid entries are AVRO, JSON_SR, PROTOBUF, or JSON. Note that you need to have Confluent Cloud Schema Registry configured if using a schema-based message format like AVRO, JSON_SR, and PROTOBUF.

• Type: string
• Default: JSON
• Importance: high

How should we connect to your data?

name

Sets a name for your connector.

• Type: string
• Valid Values: A string at most 64 characters long
• Importance: high

Kafka Cluster credentials

kafka.auth.mode

Kafka Authentication mode. It can be one of KAFKA_API_KEY or SERVICE_ACCOUNT. It defaults to KAFKA_API_KEY mode.

• Type: string
• Default: KAFKA_API_KEY
• Valid Values: KAFKA_API_KEY, SERVICE_ACCOUNT
• Importance: high

kafka.api.key

Kafka API Key. Required when kafka.auth.mode==KAFKA_API_KEY.

• Type: password
• Importance: high

kafka.service.account.id

The Service Account that will be used to generate the API keys to communicate with Kafka Cluster.

• Type: string
• Importance: high

kafka.api.secret

Secret associated with Kafka API key. Required when kafka.auth.mode==KAFKA_API_KEY.

• Type: password
• Importance: high

How should we connect to your Elasticsearch Service?

connection.url

Elasticsearch Service connection URI (e.g. https://123123.us-east-1.aws.found.io:9243).

• Type: list
• Importance: high

connection.username

The username used to authenticate with Elasticsearch Service.

• Type: string
• Importance: high

connection.password

The password used to authenticate with Elasticsearch Service.

• Type: password
• Importance: high

Security

elastic.security.protocol

This should be set to SSL if you want to enable PKI auth with SSL support. Otherwise all ssl configs are ignored. Note that the connector will still use SSL if https is used.

• Type: string
• Default: PLAINTEXT
• Importance: medium

elastic.https.ssl.keystore.file

The key store file. This is optional for client and can be used for two-way authentication for client.

• Type: password
• Importance: medium

elastic.https.ssl.key.password

The password of the private key in the key store file. This is required for clients only if two-way authentication is configured.

• Type: password
• Importance: medium

elastic.https.ssl.keystore.password

The store password for the key store file. This is optional for client and only needed if ‘ssl.keystore.location’ is configured. Key store password is not supported for PEM format.

• Type: password
• Importance: medium

elastic.https.ssl.keystore.type

The file format of the key store file. This is optional for client.

• Type: string
• Default: JKS
• Importance: medium

elastic.https.ssl.truststore.file

The Truststore file with the certificates of the trusted CAs.

• Type: password
• Importance: medium

elastic.https.ssl.truststore.password

The password for the trust store file. If a password is not set, trust store file configured will still be used, but integrity checking is disabled. Trust store password is not supported for PEM format.

• Type: password
• Importance: medium

elastic.https.ssl.truststore.type

The file format of the trust store file.

• Type: string
• Default: JKS
• Importance: medium

elastic.https.ssl.keymanager.algorithm

The algorithm used by key manager factory for SSL connections.

• Type: string
• Default: SunX509
• Importance: low

elastic.https.ssl.trustmanager.algorithm

The algorithm used by trust manager factory for SSL connections.

• Type: string
• Default: PKIX
• Importance: low

elastic.https.ssl.endpoint.identification.algorithm

The endpoint identification algorithm to validate server hostname using server certificate.

• Type: string
• Default: https
• Importance: low

Data Conversion

key.ignore

Whether to ignore the record key for the purpose of forming the Elasticsearch document ID. When this is set to true, document IDs will be generated as topic+partition+offset taken from the record. When this is set to false, the record key will be used as the Elasticsearch document ID.

• Type: boolean
• Default: false
• Importance: low

topic.key.ignore

List of topics for which key.ignore should be true.

• Type: list
• Importance: low

schema.ignore

Whether to ignore schemas during indexing. When this is set to true, the record schema will be ignored for the purpose of registering an Elasticsearch mapping. Elasticsearch will infer the mapping from the data (dynamic mapping needs to be enabled by the user).

• Type: boolean
• Default: false
• Importance: low

topic.schema.ignore

List of topics for which schema.ignore should be true.

• Type: list
• Importance: low

compact.map.entries

Defines how map entries with string keys within record values should be written to JSON. When this is set to true, these entries are written compactly as “entryKey”: “entryValue”. Otherwise, map entries with string keys are written as a nested document {“key”: “entryKey”, “value”: “entryValue”}.

• Type: boolean
• Default: true
• Importance: low

write.method

Method used for writing data to Elasticsearch, and one of INSERT or UPSERT. The default method is INSERT, in which the connector constructs a document from the record value and inserts that document into Elasticsearch, completely replacing any existing document with the same ID; this matches previous behavior. The UPSERT method will create a new document if one with the specified ID does not yet exist, or will update an existing document with the same ID by adding/replacing only those fields present in the record value. The UPSERT method may require additional time and resources of Elasticsearch, so consider increasing the read.timeout.ms and decreasing the batch.size configuration properties.

• Type: string
• Default: INSERT
• Importance: low

external.version.header

Header name to pull value for external versioning, defaults to using the kafka record offset. Must have a numeric value.

• Type: string
• Default: “”
• Importance: low

use.autogenerated.ids

Whether to use auto-generated Elasticsearch document IDs for insertion requests. Note that this setting removes exactly once guarantees and message delivery will be at least once. Only applies if write method is set to INSERT. When this is set to ‘true’, ‘Ignore Key mode’ option will also be ignored when sending data to Elasticsearch.

• Type: boolean
• Default: false
• Importance: low

Error Handling

behavior.on.null.values

How to handle records with a non-null key and a null value (i.e. Kafka tombstone records). Valid options are ignore, delete, and fail. Ignore will skip the record. Delete will delete the record. Fail will fail the connector.

• Type: string
• Default: ignore
• Importance: low

behavior.on.malformed.documents

How to handle records that Elasticsearch rejects due to some malformation of the document itself, such as an index mapping conflict, a field name containing illegal characters, or a record with a missing id. ‘ignore’ will skip the bad records and ‘fail’ will fail the connector.

• Type: string
• Default: fail
• Importance: low

drop.invalid.message

Whether to drop a record if it cannot be converted to an Elasticsearch document.

• Type: boolean
• Default: false
• Importance: low

Connection Details

batch.size

The number of records to process as a batch when writing to Elasticsearch.

• Type: int
• Default: 2000
• Valid Values: [1,…]
• Importance: medium

linger.ms

Linger time in milliseconds for batching. Records that arrive in between request transmissions are batched into a single bulk indexing request, based on the batch.size configuration. Normally this only occurs under load when records arrive faster than they can be sent out. However, it may be desirable to reduce the number of requests even under light load and benefit from bulk indexing. This setting helps accomplish that - when a pending batch is not full, rather than immediately sending it out the task will wait up to the given delay to allow other records to be added so that they can be batched into a single request.

• Type: int
• Default: 1000 (1 second)
• Valid Values: [1000,…]
• Importance: low

flush.timeout.ms

The timeout in milliseconds to use for periodic flushing, and when waiting for buffer space to be made available by completed requests as records are added. If this timeout is exceeded the task will fail.

• Type: int
• Default: 10000 (10 seconds)
• Valid Values: [1000,…]
• Importance: low

connection.compression

Whether to use GZip compression on HTTP connection to ElasticSearch. To make this setting to work the http.compression setting also needs to be enabled at the Elasticsearch nodes before using it.

• Type: boolean
• Default: false
• Importance: low

read.timeout.ms

How long to wait in milliseconds for the Elasticsearch server to send a response. The task fails if any read operation times out.

• Type: int
• Default: 15000 (15 seconds)
• Valid Values: [1000,…,60000]
• Importance: low

Consumer configuration

max.poll.interval.ms

The maximum delay between subsequent consume requests to Kafka. This configuration property may be used to improve the performance of the connector, if the connector cannot send records to the sink system. Defaults to 300000 milliseconds (5 minutes).

• Type: long
• Default: 300000 (5 minutes)
• Valid Values: [60000,…,1800000] for non-dedicated clusters and [60000,…] for dedicated clusters
• Importance: low

max.poll.records

The maximum number of records to consume from Kafka in a single request. This configuration property may be used to improve the performance of the connector, if the connector cannot send records to the sink system. Defaults to 500 records.

• Type: long
• Default: 500
• Valid Values: [1,…,500] for non-dedicated clusters and [1,…] for dedicated clusters
• Importance: low

Number of tasks for this connector

tasks.max

Maximum number of tasks for the connector.

• Type: int
• Valid Values: [1,…]
• Importance: high

Data Streams

data.stream.type

Generic type describing the data to be written to data stream. The default is none which indicates the connector will write to regular indices instead. If set, this configuration will be used alongside data.stream.dataset to construct the data stream name in the form of {`data.stream.type}-{data.stream.dataset}-{data.stream.namespace}. Possible values are logs, metrics,`none` and custom index templates defined in the destination cluster are supported as well.

• Type: string
• Default: none
• Importance: low

data.stream.dataset

Generic name describing data ingested and its structure to be written to a data stream. Can be any arbitrary string that is no longer than 100 characters, is in all lowercase, and does not contain spaces or any of these special characters /\*"<>|,#:-. Otherwise, no value indicates the connector will write to regular indices instead. If set, this configuration will be used alongside data.stream.type to construct the data stream name in the form of {data.stream.type}-{data.stream.dataset}-{data.stream.namespace}.

• Type: string
• Default: “”
• Importance: low

data.stream.namespace

Generic name describing a user-configurable arbitrary grouping for writing to a data stream. It can be any string up to 100 characters, in lowercase, without spaces or special characters (/*”<>|,#:-). If unset, the connector writes to regular indices. When set, it is used with data.stream.type and data.stream.dataset to form the data stream name in the format {data.stream.type}-{data.stream.dataset}-{data.stream.namespace}. Default is ${topic}, which means the topic name.

• Type: string
• Default: ${topic}
• Importance: low

data.stream.timestamp.field

All documents sent to a data stream needs an @timestamp field with values of type date or data_nanos. Otherwise, the document will not be sent. If multiple fields are provided, the first field listed that also appears in the record will be used. If this configuration is left empty, all of the documents will use the Kafka record timestamp as the @timestamp field value. Note that @timestamp still needs to be explicitly listed if records already contain this field. This configuration can only be set if data.stream.type and data.stream.dataset are set.

• Type: list
• Default: “”
• Importance: low

Suggested Reading

The following blog posts provide data pipeline examples using the Confluent Cloud Elasticsearch Service Sink connector.

• Blog post: Announcing the Elasticsearch Service Sink connector for Apache Kafka in Confluent Cloud
• Blog post: Analysing Historical and Live Data with ksqlDB and Elastic Cloud

Next Steps

For an example that shows fully-managed Confluent Cloud connectors in action with Confluent Cloud ksqlDB, see the Cloud ETL Demo. This example also shows how to use Confluent CLI to manage your resources in Confluent Cloud.