Data inspect

Kpow's Data inspect function allows you to quickly and easily search and filter records from multiple topics in a single query.

Records can then be easily updated and re-produced back to Kafka topics via Kpow's Data produce function.

Usage

Input Type

Data inspect has three different input types that identify which topics to search:

• Topic: search records in 1-n topics identified by topic names
• Topic Regex: search records in topics where the topics name matches a topic regex
• Group: search records in topics that are currently being consumed by a group

Mode

Data inspect has four different modes when searching topics:

• Slice: search records from one or more topics starting from a point in time
• Bounded window: search records from one or more topics with a query start and end time
• Partition: search records within a single topic partition and from an (optional) offset
• Key: search records from one or more topics, starting from a point in time and matching an exact key

Slice, Partition, or Key queries

When using Slice, Partition, or Key mode, Kpow will search records from a starting point in time, continuing until all topic partitions are exhausted or 100 results have been returned.

You may chose to manually 'continue' a query, reading further records beyond the 100 results or newly produced to the topic.

The 'From' field defines when the query starts:

• Recent: query the most recent 100 records, evenly distributed among all topics partitions.
• Last minute: query records produced in the last minute
• Last 15 minutes: query records produced in the last 15 minutes
• Last hour: query records produced in the last hour
• Last 24 hours: query records produced in the last 24 hours
• From earliest: query from the earliest record in each partition
• From timestamp: query records produced since a specific timestamp
• From datetime: query records produced since a specific local datetime

Bounded window queries

When using Bounded window mode, Kpow will search records between a start and end time, continuing until all topic partitions are exhausted or 100 results have been returned.

You may chose to manually 'continue' a query, reading further records beyond the 100 results, but once a query has reached the end it is not possible to continue further.

The 'Window start' field defines when the bounded window starts:

• Earliest: query from the earliest record in each partition
• From timestamp: query records produced since a specific timestamp
• From datetime: query records produced since a specific local datetime
• From duration ago: query records produced in the ISO8601#duration (e.g P1DT2H30M means the most recent 1 Day, 2 hours, and 30 minutes)

The 'Window end' field defines where the bounded window ends:

• Now: query until the current time
• To timestamp: query records produced until a specific timestamp
• To datetime: query records produced until a specific local datetime
• To duration from window start: query records produced until the ISO8601#duration from window start (e.g. PT15M is means a 15 minute window)

Bounded Window Durations

Kpow accepts ISO8601#duration format for all duration input, for example:

• PT15M is fifteen minutes
• PT3H15M is three hours and fifteen minutes
• P2DT3H15M is two days, three hours, and fifteen minutes
• P2W is two weeks
• P1M is one month
• P3Y6M4DT12H30M5S is three years, six months, four days, twelve hours, thirty minutes, and five seconds

Serdes

See the Serdes section for more information about using Data inspect serdes.

Filtering

Kpow offers very fast JQ-like filters for search data on topics. These filters are compiled and executed on the server, allowing you to search tens of thousands of messages a second.

See the kJQ filters section for documentation on the query language.

Headers

Select a Headers Deserializer in the Data inspect form to include Message Headers in your results.

Query Results

Results Toolbar

Query progress

Data inspect queries have a start and end cursor position. The start is defined by the window of the query, and the end position is the time in which the query was first executed. Once a query has been executed, the query metadata has the notion of "progress": how many records you have scanned, and how many records remain for the query. The green progress bar above the toolbar represents the total progress of the query. You can always click "Continue consuming" to keep progressing your cursor.

Data policies

If you have any Data policies that apply to the query that was executed, the toolbar will show you what policies matches your queries, and the redactions applied.

Result Metadata Table

Clicking the "Show metadata" button in the results toolbar will expand the Result Metadata Table, which is a table of your queries cursors across all partitions.

Result Metadata Table Explanation

• Partition: the partition the row relates to
• Partition start: the earliest offset of this partition
• Partition end: the most recent offset of this partition
• Query start: the offset that data inspect started scanning from for this partition. Calculated from the query window.
• Query end: the offset that data inspect will scan up to. Calculated from the query window.
• Scanned Records: the number of records in this partition that have been scanned
• Filtered Records: the number of records that have positively matched the key or value filters specified in the query
• Remaining Records: the number of records that remain in the query window.
• Consumed: the percentage of overall records consumed for this partition.

Configuration

Engine

SAMPLER_CONSUMER_THREADS - Kpow creates a connection pool of consumers when querying with data inspect. This environment variables specifies the number of consumer threads globally available in the pol. Default: 6.

SAMPLER_TIMEOUT_MS - a query will finish querying once 100 positively matched records have been found or after a timeout (default 7s). You can always progress the query and continue scanning by clicking "Continue Consuming".

Increase the sampler timeout to run longer queries and the consumer threads to query more partitions in parallel.

The default configuration should be suitable for most installations.

Serdes

Custom serdes + serdes configuration

See the Serdes section for details on how to configure custom serdes, integrate schema registry and more for data inspect.

TOPIC_INSPECT authorization

To enable inspection of key/value/header contents of records, set the ALLOW_TOPIC_INSPECT environment variable to true. If you are using role-based access control, view our guide here.

Data policies/redaction

To configure data policies (configurable redaction of Data inspection results) view our Data policies.