This product is not supported for your selected
Datadog site. (
).
This page covers the prerequisites and setup steps for Kafka Console.
Prerequisites
Datadog Agent version
Datadog Agent version 7.78 or later is required.
ACL permissions
If your Kafka cluster uses ACLs, the Datadog Agent user requires the following minimum permissions:
| Resource Name | Resource Type | Operation |
|---|
kafka-cluster | CLUSTER | Describe |
kafka-cluster | CLUSTER | DescribeConfigs |
* | TOPIC | Describe |
* | TOPIC | DescribeConfigs |
* | GROUP | Describe |
Setup
Enable Kafka Console by setting enable_cluster_monitoring: true in the Kafka Consumer integration.
For additional environment-specific guidance on configuring the integration, go to the Kafka Console setup page and click Get Started. Then choose your environment and follow the instructions.
You can copy the setup instructions directly to an AI agent with Copy for AI.
Enable Kafka actions
Kafka actions let you read messages, create topics, and delete topics from Kafka Console. This section applies only if you want to use these actions. Skip it if you only need monitoring.
Remote configuration
Remote configuration must be enabled at three levels:
- At the organization level.
- At the Agent level.
- At the API key level.
Additional ACL permissions
The Datadog Agent runs each action on your Kafka cluster. In addition to the ACL permissions listed in Prerequisites, grant the Agent user the ACLs for each action you plan to use:
| Action | Resource Name | Resource Type | Operation |
|---|
| Read messages | * | TOPIC | Read |
| Create a topic | * | TOPIC | Create |
| Delete a topic | * | TOPIC | Delete |
The * resource name applies the operation to all topics. To restrict an action to specific topics, replace * with those topic names.
User permissions
Each action requires a user permission:
| Action | Permission |
|---|
| Read messages | Data Streams Monitoring Capture Messages |
| Create a topic | Data Streams Monitoring Kafka Create Topic |
| Delete a topic | Data Streams Monitoring Kafka Delete Topic |
Datadog records each Kafka action in Audit Trail under the Data Streams Monitoring category. Each entry includes the user, topic, and cluster.
Deleting a topic permanently removes the topic and all of its messages. Grant the Data Streams Monitoring Kafka Delete Topic permission only to users who manage your Kafka topics.
You can verify your current permissions on your Profile page. To enable permissions, edit an existing role or create a role on the Roles page. If you do not have permission to modify roles, contact your organization’s administrator.
1. Create a role
- Navigate to the Roles page in Datadog.
- Click + New Role in the top-right corner.
If you see "Read Only" instead of the "+ New Role button", you don't have permission to create roles. Contact your Datadog administrator for assistance.
- Enter a descriptive name for your role (for example, “Kafka Actions Access”).
- In the Search Permissions field, enter the name of a permission from the User permissions table (for example,
Data Streams Monitoring Capture Messages). - Select the permission from the search results to enable it for this role. Repeat for each permission you want to grant the role.
- Click Save.
- Confirm your role was created successfully by searching for it in the roles list.
2. Assign the role to users
- Go to the Users page in Datadog.
- Find and click on the user you want to assign the role to.
- In the user details panel, click Edit next to their name.
If you don't see an Edit button, you need administrator privileges to modify user roles. Contact your Datadog administrator.
- In the modal that opens, locate the Roles section.
- Add your newly created role to the user.
- Click Save.
- Look for a User updated confirmation message to verify the change was successful.
Further reading
Additional helpful documentation, links, and articles:
