Kafka Connector | OpenMetadata Messaging Integration

In this section, we provide guides and references to use the Kafka connector. Configure and schedule Kafka metadata and profiler workflows from the OpenMetadata UI:

• Requirements
• Metadata Ingestion
• Enable Security
• Troubleshooting

​

Requirements

Connecting to Kafka does not require any previous configuration. The ingestion of the Kafka topics’ schema is done separately by configuring the Schema Registry URL. However, only the Bootstrap Servers information is mandatory. Below are the required Permissions for fetching the Metadata:

• READ TOPIC
• DESCRIBE TOPIC
• READ CLUSTER

​

Metadata Ingestion

To ingest metadata from Kafka, you need to create a service connection. The service connects Kafka with OpenMetadata. Once you create a service, OpenMetadata automatically starts ingesting metadata.

​

Step 1: Add New Service

1. Navigate to Settings > Services.
2. Click Add New Service.

​

Step 2: Select a Service and Connector

From the service type dropdown, select Messaging Services, then click the Kafka connector tile.

​

Step 3: Add Service Name and Description

• Enter a unique, descriptive Service Name. OpenMetadata identifies services by their service name. Enter a name that distinguishes this deployment from other Kafka services you are ingesting metadata from.
• Optional: Enter a Description for the service.

​

Step 4: Configure Connection Options

Specify your source credentials and verify the connection.

​

Enter Connection Details

Enter the connection details for Kafka. The right-hand panel in the UI displays inline help for each field.

• Bootstrap Servers: List of brokers as comma separated values of broker host or host:port. Example: host1:9092,host2:9092
• Schema Registry URL: URL of the Schema Registry used to ingest the schemas of the topics.
• SASL Username: SASL username for use with the PLAIN and SASL-SCRAM mechanisms.
• SASL Password: SASL password for use with the PLAIN and SASL-SCRAM mechanisms.
• SASL Mechanism: SASL mechanism to use for authentication.
• Basic Auth User Info: Schema Registry Client HTTP credentials in the form of username:password. By default, user info is extracted from the URL if present.
• Consumer Config: The accepted additional values for the consumer configuration can be found in the following link. If you are using Confluent Kafka and SSL encryption is enabled, you need to add security.protocol as key and SASL_SSL as value under Consumer Config
• Schema Registry Config: The accepted additional values for the Schema Registry configuration can be found in the following link.

​

Test Connection

Once the credentials have been added, click on Test Connection and Save the changes.

​

Step 5: Configure Ingestion Options

In the What to Ingest step, use filter patterns to control which assets OpenMetadata ingests from your messaging service. Filter patterns use regular expressions applied to topic names.

​

How Filter Patterns Work

• Include: Add one or more comma-separated regular expressions. OpenMetadata ingests only assets whose names match at least one expression. Leave blank to include all assets.
• Exclude: Add one or more comma-separated regular expressions. OpenMetadata skips any asset whose name matches an expression. Leave blank to exclude nothing.

Rules match asset names using one of five expressions:

• contains: matches any name containing the value. For example, sales matches my_sales_data and sales_2024.
• starts with: matches names beginning with the value. For example, prod_ matches prod_db and prod_schema.
• ends with: matches names ending with the value. For example, _raw matches events_raw and logs_raw.
• is exactly: matches the exact name only. For example, analytics matches only analytics.
• matches regex: matches names using a regular expression. For example, ^prod_.*_v\d+$ matches prod_events_v1.

When both Include and Exclude are set, Exclude takes priority. Filter Options The Topic section includes the following filter options:

• Topic: Controls which topics (Kafka topics, Pulsar topics, or equivalent messaging channels) OpenMetadata ingests from the source.

Each section provides the following controls:

• Scan Mode: You can choose between the following scan modes:
  • Scan all: Ingests every asset of that type the connector can access. This is the default.
  • Only specific: Enables include rules so only assets matching at least one rule are ingested.
• Exclude system toggle: Use this toggle to automatically filter out system-reserved names defined by the connector, for example, Exclude system databases for the Databases section.
• Always exclude: Add permanent exclusion rules (shown in red). Assets matching these rules are never ingested, regardless of include rules.
• Preview: Shows a real-time summary of what will be in scope based on your current rules.
• Include rules (available only in Only specific mode): Click + Add to define a rule. Added rules appear as chips; an asset is included if it matches any rule.

​

Step 6: Create & Deploy

Click Create & Deploy to deploy the agent and start the first metadata ingestion run. OpenMetadata saves the service configuration and immediately begins pulling metadata from the source. To monitor ingestion progress or view the service you just added, go to Settings > Services and select your service.

​

Configure Metadata Agent and Schedule Ingestion

The Metadata Agent extracts topics, schemas, and other structural metadata from your source and keeps your OpenMetadata catalog in sync. It powers discovery, lineage, and governance across your data assets. When you click Create & Deploy, OpenMetadata automatically deploys a Metadata Agent for this service and triggers the first ingestion run. View its status and run history from the Agents tab on the service detail page. To configure the additional Metadata Agent and schedule ingestion, follow these steps:

1. Navigate to Settings > Services and select the service type.
2. Click the service you have added.
3. Select the Agents tab and click Add Agent > Metadata. For some services, the dropdown is not available and clicking Add Agent takes you directly to the agent configuration page.
4. On the Configure Ingestion page, do the following and click Next.
   • Name this Ingestion: Enter a unique recognizable name for this ingestion pipeline.
   • Agent Setup: Configure the core parameters for this agent. The following fields are available:

     Field	Default	Description
     Generate Sample Data	Off	Option to turn on/off generating sample data during metadata extraction.
     Mark Deleted Topics	On	Soft-delete topics in OpenMetadata when they are removed from the source. Associated entities like sample data and lineage are also deleted.

     
   • Filter Patterns: Apply include or exclude rules to scope which topics this agent ingests. These follow the same filter options described in Step 5: Configure Ingestion Options.
   • Scope & Behaviour: Control what metadata to include and how to handle deletions. Toggle each option on or off based on your needs:

     Toggle	Default	Description
     Enable Debug Log	Off	Sets the ingestion log level to DEBUG. Useful for troubleshooting.
     Override Metadata	Off	When on, source values overwrite existing descriptions, tags, owners, and display names in OpenMetadata. When off, OpenMetadata only updates fields that have no existing value.

     
5. On the Schedule Interval page, set when the agent runs:
   • Schedule: Choose a preset interval (Hourly, Daily, Weekly, Monthly) or enter a custom cron expression.
   • On-Demand: No automatic schedule; trigger the agent manually when needed.
   
6. Click Add to deploy the agent.

​

Securing Kafka Connection with SSL in OpenMetadata

To establish secure connections between OpenMetadata and Kafka, navigate to the Advanced Config section. Here, you can provide the CA certificate used for SSL validation by specifying the caCertificate. Alternatively, if both client and server require mutual authentication, you’ll need to use all three parameters: ssl key, ssl cert, and caCertificate. In this case, ssl_cert is used for the client’s SSL certificate, ssl_key for the private key associated with the SSL certificate, and caCertificate for the CA certificate to validate the server’s certificate.

​

Related