<a id="rabbit-m-q-sink-connector-config"></a>

# Configuration Reference for RabbitMQ Sink Connector for Confluent Platform

To use this connector, specify the name of the connector class in the `connector.class` configuration property.

```properties
connector.class=io.confluent.connect.rabbitmq.sink.RabbitMQSinkConnector
```

Connector-specific configuration properties are described below.

#### NOTE
These are properties for the self-managed connector. If you are using
Confluent Cloud, see [RabbitMQ Sink Connector for Confluent
Cloud](/cloud/current/connectors/cc-rabbitmq-sink.html).

## Connection

`rabbitmq.host`
: The RabbitMQ host to connect to. See [ConnectionFactory.setHost(java.lang.String)](https://rabbitmq.github.io/rabbitmq-java-client/api/current/com/rabbitmq/client/ConnectionFactory.html#setHost-java.lang.String-)
  <br/>
  * Type: string
  * Default: localhost
  * Importance: high

`rabbitmq.password`
: The password to use when authenticating to RabbitMQ. See [ConnectionFactory.setPassword(java.lang.String)](https://rabbitmq.github.io/rabbitmq-java-client/api/current/com/rabbitmq/client/ConnectionFactory.html#setPassword-java.lang.String-)
  <br/>
  * Type: string
  * Default: guest
  * Importance: high

`rabbitmq.username`
: The username to use when authenticating to RabbitMQ. See [ConnectionFactory.setUsername(java.lang.String)](https://rabbitmq.github.io/rabbitmq-java-client/api/current/com/rabbitmq/client/ConnectionFactory.html#setUsername-java.lang.String-)
  <br/>
  * Type: string
  * Default: guest
  * Importance: high

`rabbitmq.virtual.host`
: The virtual host to use when connecting to the broker. See [ConnectionFactory.setVirtualHost(java.lang.String)](https://rabbitmq.github.io/rabbitmq-java-client/api/current/com/rabbitmq/client/ConnectionFactory.html#setVirtualHost-java.lang.String-)
  <br/>
  * Type: string
  * Default: /
  * Importance: high

`rabbitmq.port`
: The RabbitMQ port to connect to. See [ConnectionFactory.setPort(int)](https://rabbitmq.github.io/rabbitmq-java-client/api/current/com/rabbitmq/client/ConnectionFactory.html#setPort-int-)
  <br/>
  * Type: int
  * Default: 5672
  * Importance: medium

`rabbitmq.automatic.recovery.enabled`
: Enables or disables automatic connection recovery. See [ConnectionFactory.setAutomaticRecoveryEnabled(boolean)](https://rabbitmq.github.io/rabbitmq-java-client/api/current/com/rabbitmq/client/ConnectionFactory.html#setAutomaticRecoveryEnabled-boolean-)
  <br/>
  * Type: boolean
  * Default: true
  * Importance: low

`rabbitmq.connection.timeout.ms`
: Connection TCP establishment timeout in milliseconds. zero for infinite. See [ConnectionFactory.setConnectionTimeout(int)](https://rabbitmq.github.io/rabbitmq-java-client/api/current/com/rabbitmq/client/ConnectionFactory.html#setConnectionTimeout-int-)
  <br/>
  * Type: int
  * Default: 60000
  * Valid Values: [0,…]
  * Importance: low

`rabbitmq.handshake.timeout.ms`
: The AMQP0-9-1 protocol handshake timeout, in milliseconds. See [ConnectionFactory.setHandshakeTimeout(int)](https://rabbitmq.github.io/rabbitmq-java-client/api/current/com/rabbitmq/client/ConnectionFactory.html#setHandshakeTimeout-int-)
  <br/>
  * Type: int
  * Default: 10000
  * Importance: low

`rabbitmq.network.recovery.interval.ms`
: See [ConnectionFactory.setNetworkRecoveryInterval(long)](https://rabbitmq.github.io/rabbitmq-java-client/api/current/com/rabbitmq/client/ConnectionFactory.html#setNetworkRecoveryInterval-long-)
  <br/>
  * Type: int
  * Default: 10000
  * Importance: low

`rabbitmq.requested.channel.max`
: Initially requested maximum channel number. Zero for unlimited. See [ConnectionFactory.setRequestedChannelMax(int)](https://rabbitmq.github.io/rabbitmq-java-client/api/current/com/rabbitmq/client/ConnectionFactory.html#setRequestedChannelMax-int-)
  <br/>
  * Type: int
  * Default: 0
  * Importance: low

`rabbitmq.requested.frame.max`
: Initially requested maximum frame size, in octets. Zero for unlimited. See [ConnectionFactory.setRequestedFrameMax(int)](https://rabbitmq.github.io/rabbitmq-java-client/api/current/com/rabbitmq/client/ConnectionFactory.html#setRequestedFrameMax-int-)
  <br/>
  * Type: int
  * Default: 0
  * Importance: low

`rabbitmq.requested.heartbeat.seconds`
: Set the requested heartbeat timeout. Heartbeat frames will be sent at about 1/2 the timeout interval. If server heartbeat timeout is configured to a non-zero value, this method can only be used to lower the value; otherwise any value provided by the client will be used. See [ConnectionFactory.setRequestedHeartbeat(int)](https://rabbitmq.github.io/rabbitmq-java-client/api/current/com/rabbitmq/client/ConnectionFactory.html#setRequestedHeartbeat-int-)
  <br/>
  * Type: int
  * Default: 60
  * Importance: low

`rabbitmq.shutdown.timeout.ms`
: Set the shutdown timeout. This is the amount of time that Consumer implementations have to continue working through deliveries (and other Consumer callbacks) after the connection has closed but before the ConsumerWorkService is torn down. If consumers exceed this timeout then any remaining queued deliveries (and other Consumer callbacks, *including* the Consumer’s handleShutdownSignal() invocation) will be lost. See [ConnectionFactory.setShutdownTimeout(int)](https://rabbitmq.github.io/rabbitmq-java-client/api/current/com/rabbitmq/client/ConnectionFactory.html#setShutdownTimeout-int-)
  <br/>
  * Type: int
  * Default: 10000
  * Importance: low

`rabbitmq.topology.recovery.enabled`
: Enables or disables topology recovery. See [ConnectionFactory.setTopologyRecoveryEnabled(boolean)](https://rabbitmq.github.io/rabbitmq-java-client/api/current/com/rabbitmq/client/ConnectionFactory.html#setTopologyRecoveryEnabled-boolean-)
  <br/>
  * Type: boolean
  * Default: true
  * Importance: low

## Security

`rabbitmq.security.protocol`
: The security protocol to use when connecting to RabbitMQ. Values can be `PLAINTEXT` or `SSL`. If `PLAINTEXT` is passed, all configs prefixed by `rabbitmq.https.` or `ssl.` will be ignored.
  <br/>
  * Type: string
  * Default: `PLAINTEXT`
  * Importance: high

`rabbitmq.sasl.mechanism`
: The Simple Authentication and Security Layer (SASL) mechanism used to authenticate to RabbitMQ. `PLAIN` authenticates with `rabbitmq.username` and `rabbitmq.password`. `EXTERNAL` authenticates using the TLS client certificate presented during the mTLS handshake. The broker derives the identity from the client certificate, so the connector ignores `rabbitmq.username` and `rabbitmq.password`. Selecting `EXTERNAL` requires `rabbitmq.security.protocol` to be `SSL` with a client keystore configured, and the RabbitMQ broker must have the `rabbitmq_auth_mechanism_ssl` plugin enabled.
  <br/>
  * Type: string
  * Default: `PLAIN`
  * Valid Values: `PLAIN`, `EXTERNAL`
  * Importance: medium

`rabbitmq.https.ssl.key.password`
: The password of the private key in the key store file.
  <br/>
  * Type: password
  * Default: null
  * Importance: high

`rabbitmq.https.ssl.keystore.location`
: The location of the key store file.
  <br/>
  * Type: string
  * Default: null
  * Importance: high

`rabbitmq.https.ssl.keystore.password`
: The password for the key store file.
  <br/>
  * Type: password
  * Default: null
  * Importance: high

`rabbitmq.https.ssl.truststore.location`
: The location of the trust store file.
  <br/>
  * Type: string
  * Default: null
  * Importance: high

`rabbitmq.https.ssl.truststore.password`
: The password for the trust store file.
  <br/>
  * Type: password
  * Default: null
  * Importance: high

`rabbitmq.https.ssl.enabled.protocols`
: The list of protocols enabled for SSL connections.
  <br/>
  * Type: list
  * Default: TLSv1.2,TLSv1.1,TLSv1
  * Importance: medium

`rabbitmq.https.ssl.keystore.type`
: The file format of the key store file.
  <br/>
  * Type: string
  * Default: JKS
  * Importance: medium

`rabbitmq.https.ssl.protocol`
: The SSL protocol used to generate the SSLContext. Default setting is TLS, which is fine for most cases. Allowed values in recent JVMs are TLS, TLSv1.1 and TLSv1.2. SSL, SSLv2 and SSLv3 may be supported in older JVMs, but their usage is discouraged due to known security vulnerabilities.
  <br/>
  * Type: string
  * Default: TLS
  * Importance: medium

`rabbitmq.https.ssl.provider`
: The name of the security provider used for SSL connections. Default value is the default security provider of the JVM.
  <br/>
  * Type: string
  * Default: null
  * Importance: medium

`rabbitmq.https.ssl.truststore.type`
: The file format of the trust store file.
  <br/>
  * Type: string
  * Default: JKS
  * Importance: medium

`rabbitmq.https.ssl.cipher.suites`
: A list of cipher suites. This is a named combination of authentication, encryption, MAC and key exchange algorithm used to negotiate the security settings for a network connection using TLS or SSL network protocol. By default, all the available cipher suites are supported.
  <br/>
  * Type: list
  * Default: null
  * Importance: low

`rabbitmq.https.ssl.endpoint.identification.algorithm`
: The endpoint identification algorithm to validate server hostname using server certificate.
  <br/>
  * Type: string
  * Default: https
  * Importance: low

`rabbitmq.https.ssl.keymanager.algorithm`
: The algorithm used by key manager factory for SSL connections. Default value is the key manager factory algorithm configured for the Java Virtual Machine.
  <br/>
  * Type: string
  * Default: SunX509
  * Importance: low

`rabbitmq.https.ssl.secure.random.implementation`
: The SecureRandom PRNG implementation to use for SSL cryptography operations.
  <br/>
  * Type: string
  * Default: null
  * Importance: low

`rabbitmq.https.ssl.trustmanager.algorithm`
: The algorithm used by the trust manager factory for SSL connections. Default value is the trust manager factory algorithm configured for the Java Virtual Machine.
  <br/>
  * Type: string
  * Default: PKIX
  * Importance: low

## RabbitMQ

`rabbitmq.exchange`
: The destination RabbitMQ exchange where messages need to be delivered
  when no `rabbitmq.topic.queue.map` entry matches. The connector
  delivers messages to this RabbitMQ exchange for all unmapped topics.
  Records from a mapped topic bypass this exchange and are published
  directly to their mapped queue through the default exchange.
  <br/>
  * Type: string
  * Importance: high

`rabbitmq.routing.key`
: RabbitMQ routing key that dictates how the message travels after it
  reaches RabbitMQ. The connector applies this key only to messages
  routed through `rabbitmq.exchange` for unmapped topics. Records for
  topics listed in `rabbitmq.topic.queue.map` use the mapped queue name
  as the routing key against the default exchange instead.
  <br/>
  * Type: string
  * Importance: high

`rabbitmq.topic.queue.map`
: JSON object mapping Apache Kafka® topic names to RabbitMQ queue names, for
  example `{"topic-a":"queue-1","topic-b":"queue-2"}`. Records from a
  mapped topic are published directly to their mapped queue through the
  RabbitMQ default exchange. Unmapped topics fall back to
  `rabbitmq.exchange` with `rabbitmq.routing.key`.
  <br/>
  * Type: string
  * Default: “” (Empty string)
  * Importance: medium

`rabbitmq.delivery.mode`
: PERSISTENT or TRANSIENT, decides message durability in RabbitMQ.
  <br/>
  * Type: string
  * Valid Values: [PERSISTENT, TRANSIENT]
  * Importance: high

`rabbitmq.forward.kafka.key`
: If enabled, the Kafka record key is converted to a string and forwarded on the `correlationID` property of the RabbitMQ Message. In case the Kafka record key is null and this value is true, no `correlationID` will be sent.
  <br/>
  * Type: boolean
  * Default: false
  * Importance: low

`rabbitmq.forward.kafka.metadata`
: If enabled, metadata from the Kafka record is forwarded on the RabbitMQ Message as headers. This includes the record’s topic, partition, and offset. The topic name is applied as a header named `KAFKA_TOPIC`, the partition value is applied as a header named `KAFKA_PARTITION`, and the offset value is applied as a header named `KAFKA_OFFSET`.
  <br/>
  * Type: boolean
  * Default: false
  * Importance: low

`rabbitmq.forward.kafka.headers`
: If enabled, Kafka record headers are added to the RabbitMQ Message as headers with sent with header keys prefixed with `kafka-`.
  <br/>
  * Type: boolean
  * Default: false
  * Importance: low

## RabbitMQ Publishing

`rabbitmq.publish.max.batch.size`
: Maximum number of messages in a batch to block on for acknowledgements. This value is the maximum size of each batch and not necessarily exact in cases where there are less number of records input or less number of records pending to batched than this value. Actual max batch size will be the smaller of this value and the consumer’s `max.poll.records`.
  <br/>
  * Type: int
  * Default: 100
  * Importance: medium

`rabbitmq.publish.ack.timeout`
: Period of time to wait for message acknowledgement in milliseconds.
  <br/>
  * Type: int
  * Default: 10000
  * Importance: medium

`rabbitmq.publish.max.retries`
: Number of retries for un-acked or n-acked messages.
  <br/>
  * Type: int
  * Default: 1
  * Importance: medium

<a id="rabbitmq-sink-connector-license-config"></a>

## Confluent Platform license

`confluent.topic.bootstrap.servers`
: A list of host/port pairs to use for establishing the initial connection to the Kafka cluster used for licensing. All servers in the cluster will be discovered from the initial connection. This list should be in the form <code>host1:port1,host2:port2,…</code>. Since these servers are just used for the initial connection to discover the full cluster membership (which may change dynamically), this list need not contain the full set of servers (you may want more than one, though, in case a server is down).
  <br/>
  * Type: list
  * Importance: high

`confluent.topic`
: Name of the Kafka topic used for Confluent Platform configuration, including licensing information.
  <br/>
  * Type: string
  * Default: \_confluent-command
  * Importance: low

`confluent.topic.replication.factor`
: The replication factor for the Kafka topic used for Confluent Platform configuration, including licensing information. This is used only if the topic does not already exist, and the default of 3 is appropriate for production use. If you are using a development environment with less than 3 brokers, you must set this to the number of brokers (often 1).
  <br/>
  * Type: int
  * Default: 3
  * Importance: low

## Using SASL EXTERNAL for passwordless certificate authentication

When `rabbitmq.sasl.mechanism` is set to `EXTERNAL`, the connector authenticates with its TLS client certificate instead of a username and password. The connector ignores `rabbitmq.username` and `rabbitmq.password`. This requires:

* `rabbitmq.security.protocol` set to `SSL` with a client keystore configured, specifically the `rabbitmq.https.ssl.keystore.*` properties, so the connector presents a client certificate. Also configure a truststore with the `rabbitmq.https.ssl.truststore.*` properties to trust the broker’s server certificate.
* The RabbitMQ broker configured to accept X.509 client-certificate authentication:
  - Enable the built-in `rabbitmq_auth_mechanism_ssl` plugin.
  - Enable mutual TLS: set `ssl_options.verify = verify_peer` and `ssl_options.fail_if_no_peer_cert = true`, using the certificate authority (CA) that signed the connector’s client certificate.
  - Offer the `EXTERNAL` mechanism.
  - Map the certificate to a RabbitMQ user with `ssl_cert_login_from`, for example `common_name`. A RabbitMQ user matching that identity must exist with permissions on the target virtual host.

For broker-side setup, see the RabbitMQ guides on [mutual TLS peer verification](https://www.rabbitmq.com/docs/ssl#peer-verification-configuration) and [X.509 certificate authentication](https://www.rabbitmq.com/docs/access-control#certificate-authentication).

## Keeping certificate material out of the connector configuration

To avoid embedding keystore passwords or inline PEM-encoded certificate
material in the connector configuration, reference them from a file using
[FileConfigProvider](https://docs.confluent.io/platform/current/connect/security.html#fileconfigprovider):

```properties
config.providers=file
config.providers.file.class=org.apache.kafka.common.config.provider.FileConfigProvider
rabbitmq.https.ssl.keystore.password=${file:/var/run/secrets/rabbitmq.properties:keystore.password}
```

### Confluent license properties

You can put license-related properties in the connector configuration, or in license-related properties in the
[Connect worker configuration](https://docs.confluent.io/kafka-connectors/self-managed/license.html#centralized-license-in-the-kconnect-long-worker) instead of in each connector configuration.

This connector is proprietary and requires a license. The license information is stored in the `_confluent-command`
topic. If the broker requires SSL for connections, you must include the security-related `confluent.topic.*` properties
as described below.

`confluent.license`
: Confluent issues enterprise license keys to each subscriber. The license key is text that you can copy and
  paste as the value for `confluent.license`. A trial license allows using the connector for a 30-day trial period. A developer license allows using the connector indefinitely for single-broker development environments.
  <br/>
  If you are a subscriber, contact Confluent Support for more information.
  <br/>
  * Type: string
  * Default: “”
  * Valid Values: Confluent Platform license
  * Importance: high

`confluent.topic.ssl.truststore.location`
: The location of the trust store file.
  <br/>
  * Type: string
  * Default: null
  * Importance: high

`confluent.topic.ssl.truststore.password`
: The password for the trust store file. If a password is not set access to the truststore is still available, but
  integrity checking is disabled.
  <br/>
  * Type: password
  * Default: null
  * Importance: high

`confluent.topic.ssl.keystore.location`
: The location of the key store file. This is optional for client and can be used for two-way authentication for client.
  <br/>
  * Type: string
  * Default: null
  * Importance: high

`confluent.topic.ssl.keystore.password`
: The store password for the key store file. This is optional for client and only needed if ssl.keystore.location is configured.
  <br/>
  * Type: password
  * Default: null
  * Importance: high

`confluent.topic.ssl.key.password`
: The password of the private key in the key store file. This is optional for client.
  <br/>
  * Type: password
  * Default: null
  * Importance: high

`confluent.topic.security.protocol`
: Protocol used to communicate with brokers. Valid values are: PLAINTEXT, SSL, SASL_PLAINTEXT, SASL_SSL.
  <br/>
  * Type: string
  * Default: “PLAINTEXT”
  * Importance: medium

<a id="rabbit-m-q-sink-license-topic-configuration"></a>

### License topic configuration

A Confluent enterprise license is stored in the `_confluent-command` topic.
This topic is created by default and contains the license that corresponds to
the license key supplied through the `confluent.license` property. No public
keys are stored in Kafka topics.

The following describes how the default `_confluent-command` topic is
generated under different scenarios:

* A 30-day trial license is automatically generated for the `_confluent-command` topic if you do not add the `confluent.license` property or leave this property empty (for example, `confluent.license=`).
* Adding a valid license key (for example, `confluent.license=<valid-license-key>`) adds a valid license in the `_confluent-command` topic.

Here is an example of the minimal properties for development and testing.

You can change the name of the `_confluent-command` topic using the
`confluent.topic` property (for instance, if your environment has strict
naming conventions). The example below shows this change and the configured
Kafka bootstrap server.

```none
confluent.topic=foo_confluent-command
confluent.topic.bootstrap.servers=localhost:9092
```

The example above shows the minimally required bootstrap server property that
you can use for development and testing. For a production environment, you add
the normal producer, consumer, and topic configuration properties to the
connector properties, prefixed with `confluent.topic.`.

### License topic ACLs

The `_confluent-command` topic contains the license that corresponds to the
license key supplied through the `confluent.license` property. It is created
by default. Connectors that access this topic require the following ACLs
configured:

* CREATE and DESCRIBE on the resource cluster, if the connector needs to create the topic.
* DESCRIBE, READ, and WRITE on the `_confluent-command` topic.

  #### IMPORTANT
  You can also use DESCRIBE and READ without WRITE to restrict access to
  read-only for license topic ACLs. If a topic exists, the LicenseManager
  will not try to create the topic.

You can provide access either individually for each principal that will
use the license or use a [wildcard entry](/platform/current/kafka/authorization.html#acl-wildcard-principals) to
allow all clients. The following examples show commands that you can use to
configure ACLs for the resource cluster and `_confluent-command` topic.

1. Set a CREATE and DESCRIBE ACL on the resource cluster:
   ```none
   kafka-acls --bootstrap-server localhost:9092 --command-config adminclient-configs.conf \
   --add --allow-principal User:<principal> \
   --operation CREATE --operation DESCRIBE --cluster
   ```
2. Set a DESCRIBE, READ, and WRITE ACL on the `_confluent-command` topic:
   ```none
   kafka-acls --bootstrap-server localhost:9092 --command-config adminclient-configs.conf \
   --add --allow-principal User:<principal> \
   --operation DESCRIBE --operation READ --operation WRITE --topic _confluent-command
   ```

### Override Default Configuration Properties

You can override the replication factor using
`confluent.topic.replication.factor`. For example, when using a Kafka cluster
as a destination with less than three brokers (for development and testing) you
should set the `confluent.topic.replication.factor` property to `1`.

You can override producer-specific properties by using the
`producer.override.*` prefix (for source connectors) and consumer-specific
properties by using the `consumer.override.*` prefix (for sink connectors).

You can use the defaults or customize the other properties as well. For example,
the `confluent.topic.client.id` property defaults to the name of the connector
with `-licensing` suffix. You can specify the configuration settings for
brokers that require SSL or SASL for client connections using this prefix.

You cannot override the cleanup policy of a topic because the topic always has a
single partition and is compacted. Also, do not specify serializers and
deserializers using this prefix; they are ignored if added.