# redpanda

> For the complete documentation index, see [llms.txt](https://docs.redpanda.com/llms.txt). Component-specific: [cloud-data-platform-full.txt](https://docs.redpanda.com/cloud-data-platform-full.txt)

---
title: redpanda
latest-operator-version: v26.1.4
latest-console-tag: v3.7.3
latest-connect-version: 4.93.0
latest-redpanda-tag: v26.1.9
docname: connect/components/inputs/redpanda
page-component-name: cloud-data-platform
page-version: master
page-component-version: master
page-component-title: Cloud
page-relative-src-path: connect/components/inputs/redpanda.adoc
page-edit-url: https://github.com/redpanda-data/cloud-docs/edit/main/modules/develop/pages/connect/components/inputs/redpanda.adoc
page-git-created-date: "2024-11-19"
page-git-modified-date: "2026-05-26"
---

<!-- Source: https://docs.redpanda.com/cloud-data-platform/develop/connect/components/inputs/redpanda.md -->

**Type:** Input ▼

[Input](https://docs.redpanda.com/cloud-data-platform/develop/connect/components/inputs/redpanda/)[Cache](https://docs.redpanda.com/cloud-data-platform/develop/connect/components/caches/redpanda/)[Output](https://docs.redpanda.com/cloud-data-platform/develop/connect/components/outputs/redpanda/)[Tracer](https://docs.redpanda.com/cloud-data-platform/develop/connect/components/tracers/redpanda/)

**Available in:** Cloud, [Self-Managed](https://docs.redpanda.com/connect/components/inputs/redpanda/%20%22View%20the%20Self-Managed%20version%20of%20this%20component%22)

Consumes topic data from one or more Kafka brokers.

#### Common

```yml
inputs:
  label: ""
  redpanda:
    seed_brokers: [] # No default (optional)
    topics: [] # No default (optional)
    regexp_topics_include: [] # No default (optional)
    regexp_topics_exclude: [] # No default (optional)
    transaction_isolation_level: read_uncommitted
    consumer_group: "" # No default (optional)
    auto_replay_nacks: true
```

#### Advanced

```yml
inputs:
  label: ""
  redpanda:
    seed_brokers: [] # No default (optional)
    client_id: redpanda-connect
    tls:
      enabled: false
      skip_cert_verify: false
      enable_renegotiation: false
      root_cas: ""
      root_cas_file: ""
      client_certs: []
    sasl: [] # No default (optional)
    metadata_max_age: 1m
    request_timeout_overhead: 10s
    conn_idle_timeout: 20s
    tcp:
      connect_timeout: 0s
      keep_alive:
        idle: 15s
        interval: 15s
        count: 9
      tcp_user_timeout: 0s
    topics: [] # No default (optional)
    regexp_topics_include: [] # No default (optional)
    regexp_topics_exclude: [] # No default (optional)
    rack_id: ""
    instance_id: ""
    rebalance_timeout: 45s
    session_timeout: 1m
    heartbeat_interval: 3s
    start_offset: earliest
    fetch_max_bytes: 50MiB
    fetch_max_wait: 5s
    fetch_min_bytes: 1B
    fetch_max_partition_bytes: 1MiB
    transaction_isolation_level: read_uncommitted
    consumer_group: "" # No default (optional)
    commit_period: 5s
    partition_buffer_bytes: 1MB
    topic_lag_refresh_period: 5s
    max_yield_batch_bytes: 32KB
    unordered_processing:
      enabled: false
      checkpoint_limit: 1024
      batching:
        count: 0
        byte_size: 0
        period: ""
        check: ""
        processors: [] # No default (optional)
    auto_replay_nacks: true
    timely_nacks_maximum_wait: "" # No default (optional)
    extract_tracing_map: "" # No default (optional)
```

## [](#consumer-groups)Consumer groups

When you specify a consumer group in your configuration, this input consumes one or more topics and automatically balances the topic partitions across any other connected clients with the same consumer group. Otherwise, topics are consumed in their entirety or with explicit partitions.

## [](#delivery-guarantees)Delivery guarantees

If you choose to use consumer groups, the offsets of records received by Redpanda Connect are committed automatically. In the event of restarts, this input uses the committed offsets to resume data consumption where it left off.

Redpanda Connect guarantees at-least-once delivery. Records are only confirmed as delivered when all downstream outputs that a record is routed to have also confirmed delivery.

## [](#ordering)Ordering

To preserve the order of topic partitions:

-   Records consumed from each partition are processed and delivered in the order that they are received

-   Only one batch of records of a given partition is processed at a time


This approach means that although records from different partitions may be processed in parallel, records from the same partition are processed in sequential order.

### [](#delivery-errors)Delivery errors

The order in which records are delivered may be disrupted by delivery errors and any error-handling mechanisms that start up. Redpanda Connect leans towards at-least-once delivery unless instructed otherwise, and this includes reattempting delivery of data when the ordering of that data is no longer guaranteed.

For example, a batch of records is sent to an output broker and only a subset of records are delivered. In this scenario, Redpanda Connect (by default) attempts to deliver the records that failed, even though these delivery failures may have been sent before records that were delivered successfully.

#### [](#use-a-fallback-output)Use a fallback output

To prevent delivery errors from disrupting the order of records, you must specify a [`fallback`](https://docs.redpanda.com/cloud-data-platform/develop/connect/components/outputs/fallback/) output in your pipeline configuration. When adding a `fallback` output, it is good practice to set the `auto_retry_nacks` field to `false`. This also improves the throughput of your pipeline.

For example, the following configuration includes a `fallback` output. If Redpanda Connect fails to write delivery errors to the `foo` topic, it then attempts to write them into a dead letter queue topic (`foo_dlq`), which is retried indefinitely as a way to apply back pressure.

```yaml
output:
  fallback:
    - redpanda_common:
        topic: foo
    - retry:
        output:
          redpanda_common:
            topic: foo_dlq
```

## [](#batching)Batching

Records are processed and delivered from each partition in the same batches as they are received from brokers. Batch sizes are dynamically sized in order to optimize throughput, but you can tune them further using the following configuration fields:

-   `fetch_max_partition_bytes`

-   `fetch_max_bytes`


You can break batches down further using the [`split`](https://docs.redpanda.com/cloud-data-platform/develop/connect/components/processors/split/) processor.

## [](#metrics)Metrics

This input emits a `redpanda_lag` metric with `topic` and `partition` labels for each consumed topic. The metric records the number of produced messages that remain to be read from each topic/partition pair by the specified consumer group.

## [](#metadata)Metadata

This input adds the following metadata fields to each message:

-   `kafka_key`

-   `kafka_topic`

-   `kafka_partition`

-   `kafka_offset`

-   `kafka_lag`

-   `kafka_timestamp_ms`

-   `kafka_timestamp_unix`

-   `kafka_tombstone_message`

-   All record headers


## [](#fields)Fields

### [](#auto_replay_nacks)`auto_replay_nacks`

Whether to automatically replay messages that are rejected (nacked) at the output level. If the cause of rejections is persistent, leaving this option enabled can result in back pressure.

Set `auto_replay_nacks` to `false` to delete rejected messages. Disabling auto replays can greatly improve memory efficiency of high throughput streams, as the original shape of the data is discarded immediately upon consumption and mutation.

**Type**: `bool`

**Default**: `true`

### [](#client_id)`client_id`

An identifier for the client connection.

**Type**: `string`

**Default**: `redpanda-connect`

### [](#commit_period)`commit_period`

The period of time between each commit of the current partition offsets. Offsets are always committed during shutdown.

**Type**: `string`

**Default**: `5s`

### [](#conn_idle_timeout)`conn_idle_timeout`

The maximum duration that connections can remain idle before they are automatically closed. This field accepts Go duration format strings such as `100ms`, `1s`, or `5s`.

**Type**: `string`

**Default**: `20s`

### [](#consumer_group)`consumer_group`

An optional consumer group. When this value is specified:

-   The partitions of any topics, specified in the `topics` field, are automatically distributed across consumers sharing a consumer group

-   Partition offsets are automatically committed and resumed under this name


Consumer groups are not supported when you specify explicit partitions to consume from in the `topics` field.

**Type**: `string`

### [](#extract_tracing_map)`extract_tracing_map`

EXPERIMENTAL: A [Bloblang mapping](https://docs.redpanda.com/cloud-data-platform/develop/connect/guides/bloblang/about/) that attempts to extract an object containing tracing propagation information, which will then be used as the root tracing span for the message. The specification of the extracted fields must match the format used by the service wide tracer.

**Type**: `string`

```yaml
# Examples:
extract_tracing_map: root = @

# ---

extract_tracing_map: root = this.meta.span
```

### [](#fetch_max_bytes)`fetch_max_bytes`

The maximum number of bytes that a broker tries to send during a fetch.

If individual records are larger than the `fetch_max_bytes` value, brokers will still send them.

**Type**: `string`

**Default**: `50MiB`

### [](#fetch_max_partition_bytes)`fetch_max_partition_bytes`

The maximum number of bytes that are consumed from a single partition in a fetch request. This field is equivalent to the Java setting `fetch.max.partition.bytes`.

If a single batch is larger than the `fetch_max_partition_bytes` value, the batch is still sent so that the client can make progress.

**Type**: `string`

**Default**: `1MiB`

### [](#fetch_max_wait)`fetch_max_wait`

The maximum period of time a broker can wait for a fetch response to reach the required minimum number of bytes (`fetch_min_bytes`).

**Type**: `string`

**Default**: `5s`

### [](#fetch_min_bytes)`fetch_min_bytes`

The minimum number of bytes that a broker tries to send during a fetch. This field is equivalent to the Java setting `fetch.min.bytes`.

**Type**: `string`

**Default**: `1B`

### [](#heartbeat_interval)`heartbeat_interval`

When you specify a `consumer_group`, `heartbeat_interval` sets how frequently a consumer group member should send heartbeats to Apache Kafka. Apache Kafka uses heartbeats to make sure that a group member’s session is active.

You must set `heartbeat_interval` to less than one-third of `session_timeout`.

This field is equivalent to the Java `heartbeat.interval.ms` setting and accepts Go duration format strings such as `10s` or `2m`.

**Type**: `string`

**Default**: `3s`

### [](#instance_id)`instance_id`

When you specify a [`consumer_group`](#consumer_group), assign a unique value to `instance_id` to define the group’s static membership, which can prevent unnecessary rebalances during reconnections.

When you assign an instance ID, the client does not automatically leave the consumer group when it disconnects. To remove the client, you must use an external admin command on behalf of the instance ID.

**Type**: `string`

**Default**: `""`

### [](#max_yield_batch_bytes)`max_yield_batch_bytes`

The maximum size (in bytes) for each batch yielded by this input. This value must be less than or equal to the `partition_buffer_bytes`. If using Redpanda output, this value should not be greater than the `max_message_bytes` option value (1MB by default), and for high-throughput scenarios they should be equal.

**Type**: `string`

**Default**: `32KB`

### [](#metadata_max_age)`metadata_max_age`

The maximum period of time after which metadata is refreshed. This field accepts Go duration format strings such as `100ms`, `1s`, or `5s`.

Lower values provide more responsive topic and partition discovery but may increase broker load. Higher values reduce broker queries but can delay detection of topology changes.

**Type**: `string`

**Default**: `1m`

### [](#partition_buffer_bytes)`partition_buffer_bytes`

A buffer size (in bytes) for each consumed partition, which allows the internal queuing of records before they are flushed. Increasing this value may improve throughput but results in higher memory utilization.

Each buffer can grow slightly beyond this value.

**Type**: `string`

**Default**: `1MB`

### [](#rack_id)`rack_id`

A rack specifies where the client is physically located, and changes fetch requests to consume from the closest replica as opposed to the leader replica.

**Type**: `string`

**Default**: `""`

### [](#rebalance_timeout)`rebalance_timeout`

When you specify a [`consumer_group`](#consumer_group), `rebalance_timeout` sets a time limit for all consumer group members to complete their work and commit offsets after a rebalance has begun. The timeout excludes the time taken to detect a failed or late heartbeat, which indicates a rebalance is required. This field accepts Go duration format strings such as `100ms`, `1s`, or `5s`.

**Type**: `string`

**Default**: `45s`

### [](#regexp_topics_exclude)`regexp_topics_exclude[]`

A list of regular expression patterns for excluding topics when regex mode is enabled (using `regexp_topics_include` or the deprecated `regexp_topics` boolean). Topics matching any of these patterns will be excluded from consumption, even if they match include patterns.

Each pattern is a full regular expression evaluated against the complete topic name. Patterns are not anchored by default, so use `^` and `$` for exact matching. Exclude patterns are applied after include patterns, providing fine-grained control over topic selection.

Example: `regexp_topics_exclude: ["^_", ".**-temp$", ".**-test.*"]` excludes topics starting with underscore, ending with `-temp`, or containing `-test`.

**Type**: `array`

### [](#regexp_topics_include)`regexp_topics_include[]`

A list of regular expression patterns for matching topics to consume from. When specified, the client will periodically refresh the list of matching topics based on the `metadata_max_age` interval.

Each pattern is a full regular expression evaluated against the complete topic name. Patterns are not anchored by default, so `logs_.` **matches `my-logs_events` and `logs_errors`. Use `^logs_.`**`$` to match only topics starting with `logs_`.

This field enables regex mode (replacing the deprecated `regexp_topics` boolean) and cannot be used together with explicit `topics` lists. Use `regexp_topics_exclude` to filter out specific patterns from the matched topics.

Example: `regexp_topics_include: ["events_.**", "logs_.**"]` consumes from all topics starting with `events_` or `logs_`.

**Type**: `array`

```yaml
# Examples:
regexp_topics_include:
  - logs_.*
  - metrics_.*

# ---

regexp_topics_include:
  - "events_[0-9]+"
```

### [](#request_timeout_overhead)`request_timeout_overhead`

Grants an additional buffer or overhead to requests that have timeout fields defined. This field is based on the behavior of Apache Kafka’s `request.timeout.ms` parameter.

**Type**: `string`

**Default**: `10s`

### [](#sasl)`sasl[]`

Specify one or more methods or mechanisms of SASL authentication. They are tried in order. If the broker supports the first SASL mechanism, all connections use it. If the first mechanism fails, the client picks the first supported mechanism. If the broker does not support any client mechanisms, all connections fail.

**Type**: `object`

```yaml
# Examples:
sasl:
  - mechanism: SCRAM-SHA-512
    password: bar
    username: foo
```

### [](#sasl-aws)`sasl[].aws`

Contains AWS specific fields for when the `mechanism` is set to `AWS_MSK_IAM`.

**Type**: `object`

### [](#sasl-aws-credentials)`sasl[].aws.credentials`

Optional manual configuration of AWS credentials to use. More information can be found in [Amazon Web Services](https://docs.redpanda.com/cloud-data-platform/develop/connect/guides/cloud/aws/).

**Type**: `object`

### [](#sasl-aws-credentials-from_ec2_role)`sasl[].aws.credentials.from_ec2_role`

Use the credentials of a host EC2 machine configured to assume [an IAM role associated with the instance](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2.html).

**Type**: `bool`

### [](#sasl-aws-credentials-id)`sasl[].aws.credentials.id`

The ID of credentials to use.

**Type**: `string`

### [](#sasl-aws-credentials-profile)`sasl[].aws.credentials.profile`

A profile from `~/.aws/credentials` to use.

**Type**: `string`

### [](#sasl-aws-credentials-role)`sasl[].aws.credentials.role`

A role ARN to assume.

**Type**: `string`

### [](#sasl-aws-credentials-role_external_id)`sasl[].aws.credentials.role_external_id`

An external ID to provide when assuming a role.

**Type**: `string`

### [](#sasl-aws-credentials-secret)`sasl[].aws.credentials.secret`

The secret for the credentials being used.

> ⚠️ **CAUTION**
>
> This field contains sensitive information that usually shouldn’t be added to a configuration directly. For more information, see [Manage Secrets](https://docs.redpanda.com/cloud-data-platform/develop/connect/configuration/secret-management/) before adding it to your configuration.

**Type**: `string`

### [](#sasl-aws-credentials-token)`sasl[].aws.credentials.token`

The token for the credentials being used, required when using short term credentials.

**Type**: `string`

### [](#sasl-aws-endpoint)`sasl[].aws.endpoint`

Allows you to specify a custom endpoint for the AWS API.

**Type**: `string`

### [](#sasl-aws-region)`sasl[].aws.region`

The AWS region to target.

**Type**: `string`

### [](#sasl-aws-tcp)`sasl[].aws.tcp`

TCP socket configuration.

**Type**: `object`

### [](#sasl-aws-tcp-connect_timeout)`sasl[].aws.tcp.connect_timeout`

Maximum amount of time a dial will wait for a connect to complete. Zero disables.

**Type**: `string`

**Default**: `0s`

### [](#sasl-aws-tcp-keep_alive)`sasl[].aws.tcp.keep_alive`

TCP keep-alive probe configuration.

**Type**: `object`

### [](#sasl-aws-tcp-keep_alive-count)`sasl[].aws.tcp.keep_alive.count`

Maximum unanswered keep-alive probes before dropping the connection. Zero defaults to 9.

**Type**: `int`

**Default**: `9`

### [](#sasl-aws-tcp-keep_alive-idle)`sasl[].aws.tcp.keep_alive.idle`

Duration the connection must be idle before sending the first keep-alive probe. Zero defaults to 15s. Negative values disable keep-alive probes.

**Type**: `string`

**Default**: `15s`

### [](#sasl-aws-tcp-keep_alive-interval)`sasl[].aws.tcp.keep_alive.interval`

Duration between keep-alive probes. Zero defaults to 15s.

**Type**: `string`

**Default**: `15s`

### [](#sasl-aws-tcp-tcp_user_timeout)`sasl[].aws.tcp.tcp_user_timeout`

Maximum time to wait for acknowledgment of transmitted data before killing the connection. Linux-only (kernel 2.6.37+), ignored on other platforms. When enabled, keep\_alive.idle must be greater than this value per RFC 5482. Zero disables.

**Type**: `string`

**Default**: `0s`

### [](#sasl-extensions)`sasl[].extensions`

Key/value pairs to add to OAUTHBEARER authentication requests.

**Type**: `string`

### [](#sasl-mechanism)`sasl[].mechanism`

The SASL mechanism to use.

**Type**: `string`

| Option | Summary |
| --- | --- |
| AWS_MSK_IAM | AWS IAM based authentication as specified by the 'aws-msk-iam-auth' java library. |
| OAUTHBEARER | OAuth Bearer based authentication. |
| PLAIN | Plain text authentication. |
| REDPANDA_CLOUD_SERVICE_ACCOUNT | Redpanda Cloud Service Account authentication when running in Redpanda Cloud. |
| SCRAM-SHA-256 | SCRAM based authentication as specified in RFC5802. |
| SCRAM-SHA-512 | SCRAM based authentication as specified in RFC5802. |
| none | Disable sasl authentication |

### [](#sasl-password)`sasl[].password`

A password to provide for PLAIN or SCRAM-\* authentication.

> ⚠️ **CAUTION**
>
> This field contains sensitive information that usually shouldn’t be added to a configuration directly. For more information, see [Manage Secrets](https://docs.redpanda.com/cloud-data-platform/develop/connect/configuration/secret-management/) before adding it to your configuration.

**Type**: `string`

**Default**: `""`

### [](#sasl-token)`sasl[].token`

The token to use for a single session’s OAUTHBEARER authentication.

**Type**: `string`

**Default**: `""`

### [](#sasl-username)`sasl[].username`

A username to provide for PLAIN or SCRAM-\* authentication.

**Type**: `string`

**Default**: `""`

### [](#seed_brokers)`seed_brokers[]`

A list of broker addresses to connect to in order. Use commas to separate multiple addresses in a single list item. Optional when `seed_brokers` is configured in a top-level `redpanda` block.

**Type**: `array`

```yaml
# Examples:
seed_brokers:
  - "localhost:9092"

# ---

seed_brokers:
  - "foo:9092"
  - "bar:9092"

# ---

seed_brokers:
  - "foo:9092,bar:9092"
```

### [](#session_timeout)`session_timeout`

When you specify a `consumer_group`, `session_timeout` sets the maximum interval between heartbeats sent by a consumer group member to the broker. If a broker doesn’t receive a heartbeat from a group member before the timeout expires, it removes the member from the consumer group and initiates a rebalance. This field accepts Go duration format strings such as `100ms`, `1s`, or `5s`.

**Type**: `string`

**Default**: `1m`

### [](#start_offset)`start_offset`

Specify the offset from which this input starts or restarts consuming messages. Restarts occur when the `OffsetOutOfRange` error is seen during a fetch.

**Type**: `string`

**Default**: `earliest`

| Option | Summary |
| --- | --- |
| committed | Prevents consuming a partition in a group if the partition has no prior commits. Corresponds to Kafka’s auto.offset.reset=none option |
| earliest | Start from the earliest offset. Corresponds to Kafka’s auto.offset.reset=earliest option. |
| latest | Start from the latest offset. Corresponds to Kafka’s auto.offset.reset=latest option. |

### [](#tcp)`tcp`

Configure TCP socket-level settings to optimize network performance and reliability. These low-level controls are useful for:

-   **High-latency networks**: Increase `connect_timeout` to allow more time for connection establishment

-   **Long-lived connections**: Configure `keep_alive` settings to detect and recover from stale connections

-   **Unstable networks**: Tune keep-alive probes to balance between quick failure detection and avoiding false positives

-   **Linux systems with specific requirements**: Use `tcp_user_timeout` (Linux 2.6.37+) to control data acknowledgment timeouts


Most users should keep the default values. Only modify these settings if you’re experiencing connection stability issues or have specific network requirements.

**Type**: `object`

### [](#tcp-connect_timeout)`tcp.connect_timeout`

Maximum amount of time a dial will wait for a connect to complete. Zero disables.

**Type**: `string`

**Default**: `0s`

### [](#tcp-keep_alive)`tcp.keep_alive`

TCP keep-alive probe configuration.

**Type**: `object`

### [](#tcp-keep_alive-count)`tcp.keep_alive.count`

Maximum unanswered keep-alive probes before dropping the connection. Zero defaults to 9.

**Type**: `int`

**Default**: `9`

### [](#tcp-keep_alive-idle)`tcp.keep_alive.idle`

Duration the connection must be idle before sending the first keep-alive probe. Zero defaults to 15s. Negative values disable keep-alive probes.

**Type**: `string`

**Default**: `15s`

### [](#tcp-keep_alive-interval)`tcp.keep_alive.interval`

Duration between keep-alive probes. Zero defaults to 15s.

**Type**: `string`

**Default**: `15s`

### [](#tcp-tcp_user_timeout)`tcp.tcp_user_timeout`

Maximum time to wait for acknowledgment of transmitted data before killing the connection. Linux-only (kernel 2.6.37+), ignored on other platforms. When enabled, keep\_alive.idle must be greater than this value per RFC 5482. Zero disables.

**Type**: `string`

**Default**: `0s`

### [](#timely_nacks_maximum_wait)`timely_nacks_maximum_wait`

EXPERIMENTAL: Specify a maximum period of time in which each message can be consumed and awaiting either acknowledgement or rejection before rejection is instead forced. This can be useful for avoiding situations where certain downstream components can result in blocked confirmation of delivery that exceeds SLAs. Accepts Go duration format strings such as `100ms`, `1s`, or `5s`.

**Type**: `string`

### [](#tls)`tls`

Configure Transport Layer Security (TLS) settings to secure network connections. This includes options for standard TLS as well as mutual TLS (mTLS) authentication where both client and server authenticate each other using certificates. Key configuration options include `enabled` to enable TLS, `client_certs` for mTLS authentication, `root_cas`/`root_cas_file` for custom certificate authorities, and `skip_cert_verify` for development environments.

**Type**: `object`

### [](#tls-client_certs)`tls.client_certs[]`

A list of client certificates for mutual TLS (mTLS) authentication. Configure this field to enable mTLS, authenticating the client to the server with these certificates.

You must set `tls.enabled: true` for the client certificates to take effect.

**Certificate pairing rules**: For each certificate item, provide either:

-   Inline PEM data using both `cert` **and** `key` or

-   File paths using both `cert_file` **and** `key_file`.


Mixing inline and file-based values within the same item is not supported.

**Type**: `object`

**Default**: `[]`

```yaml
# Examples:
client_certs:
  - cert: foo
    key: bar

# ---

client_certs:
  - cert_file: ./example.pem
    key_file: ./example.key
```

### [](#tls-client_certs-cert)`tls.client_certs[].cert`

A plain text certificate to use.

**Type**: `string`

**Default**: `""`

### [](#tls-client_certs-cert_file)`tls.client_certs[].cert_file`

The path of a certificate to use.

**Type**: `string`

**Default**: `""`

### [](#tls-client_certs-key)`tls.client_certs[].key`

A plain text certificate key to use.

> ⚠️ **CAUTION**
>
> This field contains sensitive information that usually shouldn’t be added to a configuration directly. For more information, see [Manage Secrets](https://docs.redpanda.com/cloud-data-platform/develop/connect/configuration/secret-management/) before adding it to your configuration.

**Type**: `string`

**Default**: `""`

### [](#tls-client_certs-key_file)`tls.client_certs[].key_file`

The path of a certificate key to use.

**Type**: `string`

**Default**: `""`

### [](#tls-client_certs-password)`tls.client_certs[].password`

A plain text password for when the private key is password encrypted in PKCS#1 or PKCS#8 format. The obsolete `pbeWithMD5AndDES-CBC` algorithm is not supported for the PKCS#8 format.

Because the obsolete pbeWithMD5AndDES-CBC algorithm does not authenticate the ciphertext, it is vulnerable to padding oracle attacks that can let an attacker recover the plaintext.

> ⚠️ **CAUTION**
>
> This field contains sensitive information that usually shouldn’t be added to a configuration directly. For more information, see [Manage Secrets](https://docs.redpanda.com/cloud-data-platform/develop/connect/configuration/secret-management/) before adding it to your configuration.

**Type**: `string`

**Default**: `""`

```yaml
# Examples:
password: foo

# ---

password: ${KEY_PASSWORD}
```

### [](#tls-enable_renegotiation)`tls.enable_renegotiation`

Whether to allow the remote server to request renegotiation. Enable this option if you’re seeing the error message `local error: tls: no renegotiation`.

**Type**: `bool`

**Default**: `false`

### [](#tls-enabled)`tls.enabled`

Whether custom TLS settings are enabled.

**Type**: `bool`

**Default**: `false`

### [](#tls-root_cas)`tls.root_cas`

Specify a root certificate authority to use (optional). This is a string that represents a certificate chain from the parent-trusted root certificate, through possible intermediate signing certificates, to the host certificate. Use either this field for inline certificate data or `root_cas_file` for file-based certificate loading.

> ⚠️ **CAUTION**
>
> This field contains sensitive information that usually shouldn’t be added to a configuration directly. For more information, see [Manage Secrets](https://docs.redpanda.com/cloud-data-platform/develop/connect/configuration/secret-management/) before adding it to your configuration.

**Type**: `string`

**Default**: `""`

```yaml
# Examples:
root_cas: |-
  -----BEGIN CERTIFICATE-----
  ...
  -----END CERTIFICATE-----
```

### [](#tls-root_cas_file)`tls.root_cas_file`

Specify the path to a root certificate authority file (optional). This is a file, often with a `.pem` extension, which contains a certificate chain from the parent-trusted root certificate, through possible intermediate signing certificates, to the host certificate. Use either this field for file-based certificate loading or `root_cas` for inline certificate data.

**Type**: `string`

**Default**: `""`

```yaml
# Examples:
root_cas_file: ./root_cas.pem
```

### [](#tls-skip_cert_verify)`tls.skip_cert_verify`

Whether to skip server-side certificate verification. Set to `true` only for testing environments as this reduces security by disabling certificate validation. When using self-signed certificates or in development, this may be necessary, but should never be used in production. Consider using `root_cas` or `root_cas_file` to specify trusted certificates instead of disabling verification entirely.

**Type**: `bool`

**Default**: `false`

### [](#topic_lag_refresh_period)`topic_lag_refresh_period`

The interval between refresh cycles. During each cycle, this input queries the Redpanda Connect server to calculate the topic lag minus the number of produced messages that remain to be read from each topic/partition pair by the specified consumer group. This field accepts Go duration format strings such as `100ms`, `1s`, or `5s`.

**Type**: `string`

**Default**: `5s`

### [](#topics)`topics[]`

A list of topics to consume from. Use commas to separate multiple topics in a single element.

When a `consumer_group` is specified, partitions are automatically distributed across consumers of a topic. Otherwise, all partitions are consumed.

Alternatively, you can specify explicit partitions to consume by using a colon after the topic name. For example, `foo:0` would consume the partition `0` of the topic foo. This syntax supports ranges. For example, `foo:0-10` would consume partitions `0` through to `10` inclusive.

It is also possible to specify an explicit offset to consume from by adding another colon after the partition. For example, `foo:0:10` would consume the partition `0` of the topic `foo` starting from the offset `10`. If the offset is not present (or remains unspecified) then the field `start_offset` determines which offset to start from.

**Type**: `array`

```yaml
# Examples:
topics:
  - foo
  - bar

# ---

topics:
  - things.*

# ---

topics:
  - "foo,bar"

# ---

topics:
  - "foo:0"
  - "bar:1"
  - "bar:3"

# ---

topics:
  - "foo:0,bar:1,bar:3"

# ---

topics:
  - "foo:0-5"
```

### [](#transaction_isolation_level)`transaction_isolation_level`

The isolation level for handling transactional messages. This setting determines how transactions are processed and affects data consistency guarantees.

**Type**: `string`

**Default**: `read_uncommitted`

| Option | Summary |
| --- | --- |
| read_committed | If set, only committed transactional records are processed. |
| read_uncommitted | If set, then uncommitted records are processed. |

### [](#unordered_processing)`unordered_processing`

Allows consumers to process messages of any given partition in parallel, which may result in unordered processing. This option enables asynchronous publishing at the output level. The maximum parallelization of each partition is determined by the `checkpoint_limit` field.

**Type**: `object`

### [](#unordered_processing-batching)`unordered_processing.batching`

Allows you to configure a [batching policy](https://docs.redpanda.com/cloud-data-platform/develop/connect/configuration/batching/) that applies to individual topic partitions in order to batch messages together before flushing them for processing. Batching can be beneficial for performance and useful for windowed processing, and doing so preserves the ordering of topic partitions.

**Type**: `object`

```yaml
# Examples:
batching:
  byte_size: 5000
  count: 0
  period: 1s

# ---

batching:
  count: 10
  period: 1s

# ---

batching:
  check: this.contains("END BATCH")
  count: 0
  period: 1m
```

### [](#unordered_processing-batching-byte_size)`unordered_processing.batching.byte_size`

The number of bytes at which the batch is flushed. Set to `0` to disable size-based batching.

**Type**: `int`

**Default**: `0`

### [](#unordered_processing-batching-check)`unordered_processing.batching.check`

A [Bloblang query](https://docs.redpanda.com/cloud-data-platform/develop/connect/guides/bloblang/about/) that returns a boolean value indicating whether a message should end a batch.

**Type**: `string`

**Default**: `""`

```yaml
# Examples:
check: this.type == "end_of_transaction"
```

### [](#unordered_processing-batching-count)`unordered_processing.batching.count`

The number of messages after which the batch is flushed. Set to `0` to disable count-based batching.

**Type**: `int`

**Default**: `0`

### [](#unordered_processing-batching-period)`unordered_processing.batching.period`

The period of time after which an incomplete batch is flushed regardless of its size. This field accepts Go duration format strings such as `100ms`, `1s`, or `5s`.

**Type**: `string`

**Default**: `""`

```yaml
# Examples:
period: 1s

# ---

period: 1m

# ---

period: 500ms
```

### [](#unordered_processing-batching-processors)`unordered_processing.batching.processors[]`

A list of [processors](https://docs.redpanda.com/cloud-data-platform/develop/connect/components/processors/about/) to apply to a batch as it is flushed. This allows you to aggregate and archive the batch however you see fit. All resulting messages are flushed as a single batch, and therefore splitting the batch into smaller batches using these processors is a no-op.

**Type**: `processor`

```yaml
# Examples:
processors:
  - archive:
      format: concatenate

# ---

processors:
  - archive:
      format: lines

# ---

processors:
  - archive:
      format: json_array
```

### [](#unordered_processing-checkpoint_limit)`unordered_processing.checkpoint_limit`

Determines how many messages of the same partition can be processed in parallel before applying back pressure. When a message of a given offset is delivered to the output the offset is only allowed to be committed when all messages of prior offsets have also been delivered, this ensures at-least-once delivery guarantees. However, this mechanism also increases the likelihood of duplicates in the event of crashes or server faults, reducing the checkpoint limit will mitigate this.

**Type**: `int`

**Default**: `1024`

### [](#unordered_processing-enabled)`unordered_processing.enabled`

Whether to enable the unordered processing of messages from a given partition.

**Type**: `bool`

**Default**: `false`