Sink Configuration Settings

org.neo4j.connectors.kafka.sink.Neo4jConnector

A compatible Kafka Connect converter.

Could be one of;

Schema Registry URL for message keys. Required when a schema registry is required by the configured key.converter.

Should be set to true when key.converter is io.confluent.connect.protobuf.ProtobufConverter.

A compatible Kafka Connect converter.

Could be one of;

Schema Registry URL for message values. Required when a schema registry is required by the configured value.converter.

Should be set to true when value.converter is io.confluent.connect.protobuf.ProtobufConverter.

Neo4j URI to connect to. Multiple URIs can be specified separated by ,.

Neo4j database name to connect to. Recommended to be specified explicitly.

Authentication provider to use. One of none, basic, kerberos, bearer, custom, oidc, or the name of your own provider. The value is case-insensitive.

Default: basic

Username to authenticate with. Required when neo4j.authentication.type is basic.

Password to authenticate with. Required when neo4j.authentication.type is basic.

Authentication realm to authenticate with, leave empty for default.

Kerberos ticket to establish connection with. Required when neo4j.authentication.type is kerberos.

Bearer token to establish connection with. Required when neo4j.authentication.type is bearer.

Custom authentication scheme to establish connection with. Required when neo4j.authentication.type is custom.

Custom principal to establish connection with. Required when neo4j.authentication.type is custom.

Custom credential to establish connection with. Required when neo4j.authentication.type is custom.

Custom authentication realm to authenticate with, set as required by your custom authentication provider.

Issuer URL. The token endpoint is read from {issuer}/.well-known/openid-configuration. One of issuer, discoveryUrl or tokenEndpoint is required when neo4j.authentication.type is oidc.

Discovery document URL, given directly. The document must contain issuer and token_endpoint.

Default: derived from issuer

Issuer that the discovery document must contain. Set it only when the identity provider is reached at one address and advertises another, for example behind a reverse proxy. Must match the iss claim of the tokens.

Default: value of issuer

Token endpoint URL, given directly. Skips discovery.

Default: from the discovery document

OAuth 2.0 grant used to obtain tokens. One of client_credentials, password, refresh_token, jwt_bearer, token_exchange.

Default: client_credentials

Space-separated scopes.

Value of the audience request parameter.

Value of the resource request parameter.

Additional request parameter <name>, sent as is. Overrides any other parameter with the same name.

Username. Required when neo4j.authentication.oidc.grantType is password.

Password. Required when neo4j.authentication.oidc.grantType is password.

Initial refresh token. The connector uses the new refresh token when the identity provider rotates it. Required when neo4j.authentication.oidc.grantType is refresh_token.

File that holds the subject token. The file is read on every token request. Required when neo4j.authentication.oidc.grantType is token_exchange.

Subject token type, for the token_exchange grant.

Default: urn:ietf:params:oauth:token-type:jwt

Client identifier. Required unless neo4j.authentication.oidc.clientAuthMethod is none.

Client secret.

File that holds the client secret, instead of clientSecret. The file is read on every token request, so a rotated secret is picked up.

How the client authenticates to the token endpoint. One of client_secret_basic, client_secret_post, private_key_jwt, none. Cannot be none with the client_credentials grant.

Default: client_secret_basic

PKCS#8 private key file, PEM or DER, for private_key_jwt and the jwt_bearer grant.

Key identifier, the kid header of the signed JWT.

Signing algorithm. One of RS256, RS384, RS512, PS256, PS384, PS512, ES256, ES384, ES512.

Default: RS256

Claim <name> of the signed JWT. iss, sub, aud, iat, exp and jti are set automatically unless set here. Integer and boolean values are sent as such.

Validity of the signed JWT, in seconds.

Default: 300

Response field that holds the token. One of access_token, id_token.

Default: access_token

Number of seconds before expiry at which the token is treated as expired.

Default: 30

Token lifetime, in seconds, when the response has no expires_in and the token is not a JWT.

Default: 300

Connection timeout to the identity provider, in milliseconds.

Default: 10000

Request timeout to the identity provider, in milliseconds.

Default: 30000

Number of retries on timeout and on HTTP 408, 429 and 5xx responses. The connector does not retry invalid_client and invalid_grant errors.

Default: 3

Initial delay between retries, in milliseconds. The delay doubles on every retry, up to 30 seconds. A Retry-After response header takes precedence.

Default: 500

Trust store for TLS connections to the identity provider, for example for a private certificate authority.

Default: JDK trust store

Password of neo4j.authentication.oidc.trustStoreFile.

Type of neo4j.authentication.oidc.trustStoreFile.

Default: PKCS12

HTTP proxy host for connections to the identity provider. Set together with proxyPort.

Default: JDK setting

HTTP proxy port for connections to the identity provider. Set together with proxyHost.

Default: JDK setting

Set of default values for a well-known identity provider. Settings you configure override the profile values. One of google, okta, entra.

TCP connection timeout (valid units are: ms, s, m, h and d; default unit is s).

Default: 30s (Driver default)

Maximum number of connections to keep in the connection pool.

Default: 100 (Driver default)

Maximum duration to wait for acquiring a connection from the connection pool (valid units are: ms, s, m, h and d; default unit is s).

Default: 60s (Driver default)

Duration after which idle connections are tested for liveness (valid units are: ms, s, m, h and d; default unit is s).

Default: no test (Driver default)

Duration after which a connection is dropped from the connection pool (valid units are: `ms, s, m, h and d; default unit is s).

Default: 1h (Driver default)

Maximum duration to retry a transaction.

Default: 30s

Whether encryption is enabled. Only applicable when bolt or neo4j schemes are used inside neo4j.uri. One of true, false

Default: false.

Trust strategy to use for TLS connections. One of TRUST_ALL_CERTIFICATES, TRUST_SYSTEM_CA_SIGNED_CERTIFICATES, TRUST_CUSTOM_CA_SIGNED_CERTIFICATES Required when neo4j.security.encrypted is true.

Default: TRUST_SYSTEM_CA_SIGNED_CERTIFICATES

List of files that contain X509 certificates of CAs to trust. Required when neo4j.security.trust-strategy is TRUST_CUSTOM_CA_SIGNED_CERTIFICATES.

Whether hostname verification is enabled during TLS handshake. One of true, false.

Default: true

Maximum number of messages processed per transaction per topic.

Default: 1000

Maximum amount of time a batch is allowed to be processed (valid units are: ms, s, m, h and d; default unit is s).

Default: 0s

Maximum number of subqueries to be included in the batched Cypher statement generated by the native batching strategy for sink handlers.

Default: 50

Label name to attach to the node representing the offset of the last successfully processed message. When specified, this setting allows to achieve exactly-once processing guarantees for sink strategies by keeping track of the last successfully processed message offset in the database. The label must have a node key constraint on the strategy, topic and partition properties, or a uniqueness constraint on Neo4j Community Edition. The sink task fails to start when the constraint is missing.

Whether to create the constraint for neo4j.eos-offset-label when it is missing. The connector creates it when a task starts. The connector user must have permission to create constraints.

Default: false

Cypher statement to run for the specified topic. Example: "neo4j.cypher.topic.my-topic": "MERGE (n:Person {name: __value.name})"

Under what name message timestamp will be bound in user provided Cypher statements. Set to empty string to disable binding of message timestamp.

Default: __timestamp

Under what name message header will be bound in user provided Cypher statements. Message headers will be bound as a map of header names to corresponding values. Set to empty string to disable binding of message headers.

Default: __header

Under what name message key will be bound in user provided Cypher statements. Set to empty string to disable binding of message key.

Default: __key

Under what name message value will be bound in user provided Cypher statements. Set to empty string to disable binding of message value.

Default: __value

Whether message value will be bound as 'event' in user provided Cypher statements for backward compatibility.

Default: true

Node or relationship pattern to apply on the messages received from the specified topic. Example: "neo4j.pattern.topic.user": "(:User\{!userId})" Example: "neo4j.pattern.topic.user": "(:User\{!userId})-[:KNOWS]→(:User\{!otherUserId})"

Whether to merge incoming properties with existing properties of nodes.

Default: false

Whether to merge incoming properties with existing properties of relationships.

Default: false

Under what name message timestamp will be bound in patterns. Set to empty string to disable binding of message timestamp.

Default: __timestamp

Under what name message header will be bound in patterns. Message headers will be bound as a map of header names to corresponding values. Set to empty string to disable binding of message headers.

Default: __header

Under what name message key will be bound in patterns. Set to empty string to disable binding of message key.

Default: __key

Under what name message value will be bound in patterns. Set to empty string to disable binding of message value.

Default: __value

The topic(s) that contain CDC events generated by a Source instance of this connector using CDC source strategy, applied using the CDC Schema strategy.

The topic(s) that contain CDC events generated by a Source instance of this connector using CDC source strategy, applied using the CDC Source Id strategy.

The label name attached to the nodes managed by the CDC Source Id strategy.

Default: SourceEvent

The id property name attached to the nodes managed by the CDC Source Id strategy.

Default: sourceId

The topic(s) that contain CUD events.