Kafka Log

Release date 2026/09/15

Feature

• Added schema_registry.confluent.authentication.logical_cluster_id and .identity_pool_id configuration options, sent as the target-sr-cluster and Confluent-Identity-Pool-Id request headers when authenticating to Confluent Cloud Schema Registry with oauth2 mode.

Bugfix

• Fixed the confluent schema registry client caching fetched schemas and subjects under keys that did not account for the registry URL or authentication. Instances configured with different credentials could be served each other’s cached lookups, letting an unauthorized instance bypass schema-registry authentication once any authorized instance had warmed the cache. Cache entries are now scoped to the registry identity, and the configured schema_registry.confluent.ttl is now applied to these cache entries.

• Fixed a crash that occurred when a plugin set schema_registry.confluent.authentication.mode to oauth2 but omitted the oauth2_client record. Previously this returned a 500 from the Admin API during validation, and once saved it also crashed at runtime while fetching the schema registry OAuth2 token. The absent oauth2_client is now handled and falls back to the default authentication method, so a configuration without oauth2_client works end-to-end.

• Fixed a permanent failure that started when a broker answered an ApiVersions request with an error code, an empty API key set, or a malformed frame. The client cached that result and every later request failed with ProduceRequest API version not negotiated; broker may be unreachable until the node restarted, even after the broker recovered. The client now refuses an unusable ApiVersions response, keeps the previous negotiation, and retries the negotiation for a topic whose metadata is already cached.

Performance

• Added an improved asynchronous Kafka producer, opt-in via the new new_kafka_async_producer config option (default false). When enabled, it batches and sends messages more efficiently under high load. Messages without a key are packed into larger per-partition batches; because Kafka does not guarantee ordering across partitions, their relative order may change. Set a message key if ordering matters — keyed messages are unaffected. The legacy producer remains the default.

Release date 2026/08/24

Bugfix

• Fixed a permanent failure that started when a broker answered an ApiVersions request with an error code, an empty API key set, or a malformed frame. The client cached that result and every later request failed with ProduceRequest API version not negotiated; broker may be unreachable until the node restarted, even after the broker recovered. The client now refuses an unusable ApiVersions response, keeps the previous negotiation, and retries the negotiation for a topic whose metadata is already cached.

• Fixed the confluent schema registry client caching fetched schemas and subjects under keys that did not account for the registry URL or authentication. Instances configured with different credentials could be served each other’s cached lookups, letting an unauthorized instance bypass schema-registry authentication once any authorized instance had warmed the cache. Cache entries are now scoped to the registry identity, and the configured schema_registry.confluent.ttl is now applied to these cache entries.

• Fixed a crash that occurred when a plugin set schema_registry.confluent.authentication.mode to oauth2 but omitted the oauth2_client record. Previously this returned a 500 from the Admin API during validation, and once saved it also crashed at runtime while fetching the schema registry OAuth2 token. The absent oauth2_client is now handled and falls back to the default authentication method, so a configuration without oauth2_client works end-to-end.

• Fixed an issue where OAuth2 authentication against Confluent Cloud Schema Registry failed because the client did not send the required target-sr-cluster header.

Release date 2026/07/02

Feature

• Added SASL OAUTHBEARER authentication support.

Bugfix

• Fixed an issue where cached producers could cause memory leaks.

Release date 2026/08/26

Bugfix

• Fixed a permanent failure that started when a broker answered an ApiVersions request with an error code, an empty API key set, or a malformed frame. The client cached that result and every later request failed with ProduceRequest API version not negotiated; broker may be unreachable until the node restarted, even after the broker recovered. The client now refuses an unusable ApiVersions response, keeps the previous negotiation, and retries the negotiation for a topic whose metadata is already cached.

• Fixed an issue where OAuth2 authentication against Confluent Cloud Schema Registry failed because the client did not send the required target-sr-cluster header.

Release date 2026/07/29

Bugfix

• Fixed a crash that occurred when a plugin set schema_registry.confluent.authentication.mode to oauth2 but omitted the oauth2_client record. Previously this returned a 500 from the Admin API during validation, and once saved it also crashed at runtime while fetching the schema registry OAuth2 token. The absent oauth2_client is now handled and falls back to the default authentication method, so a configuration without oauth2_client works end-to-end.

Release date 2026/04/28

Bugfix

• Fixed an issue where cached producers could cause memory leaks.

Release date 2026/04/07

Feature

• The options security.ssl_verify which control SSL certificate verification for Kafka endpoints, are now enabled by default.

Release date 2026/08/20

Bugfix

• Fixed a crash that occurred when a plugin set schema_registry.confluent.authentication.mode to oauth2 but omitted the oauth2_client record. Previously this returned a 500 from the Admin API during validation, and once saved it also crashed at runtime while fetching the schema registry OAuth2 token. The absent oauth2_client is now handled and falls back to the default authentication method, so a configuration without oauth2_client works end-to-end.

• Fixed an issue where OAuth2 authentication against Confluent Cloud Schema Registry failed because the client did not send the required target-sr-cluster header.

Release date 2026/04/08

Bugfix

• Fixed an issue where cached producers could cause memory leaks.

Release date 2025/12/18

Feature

• added new config option ssl_verify to support verifying server certificates. Added support for the tls_certificate_verify global option. When this option is enabled, the plugin’s ssl_verify setting cannot be disabled.

Release date 2026/09/02

Bugfix

• Fixed a permanent failure that started when a broker answered an ApiVersions request with an error code, an empty API key set, or a malformed frame. The client cached that result and every later request failed with ProduceRequest API version not negotiated; broker may be unreachable until the node restarted, even after the broker recovered. The client now refuses an unusable ApiVersions response, keeps the previous negotiation, and retries the negotiation for a topic whose metadata is already cached.

Release date 2026/08/18

Bugfix

• Fixed a crash that occurred when a plugin set schema_registry.confluent.authentication.mode to oauth2 but omitted the oauth2_client record. Previously this returned a 500 from the Admin API during validation, and once saved it also crashed at runtime while fetching the schema registry OAuth2 token. The absent oauth2_client is now handled and falls back to the default authentication method, so a configuration without oauth2_client works end-to-end.

Release date 2026/07/22

Bugfix

• Fixed Kafka keepalive pools leaking connections across different SASL credentials and TLS verification settings.

• Fixed Kafka broker returning failed connections to the keepalive pool, added SSL handshake retry, and improved error propagation.

Release date 2026/04/15

Bugfix

• Fixed an issue where cached producers could cause memory leaks.

Release date 2026/02/26

Bugfix

• Fixed an issue where certificates could not be loaded from non-default workspaces.

Release date 2025/07/03

Feature

• Added support for Kafka 4.0. kafka-upstream: Added support for Kafka 4.0.

• Added support for sending messages with dynamic keys to determine partitions.

• Added support for Schema Registry integration with Confluent Schema Registry for AVRO and JSON schemas.

Release date 2026/08/31

Bugfix

• Fixed a permanent failure that started when a broker answered an ApiVersions request with an error code, an empty API key set, or a malformed frame. The client cached that result and every later request failed with ProduceRequest API version not negotiated; broker may be unreachable until the node restarted, even after the broker recovered. The client now refuses an unusable ApiVersions response, keeps the previous negotiation, and retries the negotiation for a topic whose metadata is already cached.

Release date 2026/04/09

Feature

• Added support for Kafka 4.0 to fix the Confluent deprecation.

Bugfix

• Fixed an issue where certificates could not be loaded from non-default workspaces.

Release date 2024/12/12

Bugfix

• Fixed an issue where the plugin cannot function correctly when it is configured in a non-default workspace with certificate_id.

• Reduced noisy logs from kafka-log and counters.

Release date 2023/08/09

Feature

• The Kafka Log plugin now supports the custom_fields_by_lua configuration for dynamic modification of log fields using Lua code.

Bugfix

• Fixed an issue where the plugin could lose connection to a broker when the broker leadership changed.

Release date 2022/12/06

Feature

• WebSocket service/route support was added for logging plugins: kafka-log