{"id":"278a447a-bf8f-4e8c-afdb-0a3d12e72bdf","task":"Configure Kafka Connect with a custom SMT to mask or hash PII fields before records reach a sink connector","domain":"kafka.apache.org","steps":["Implement a Transformation<R extends ConnectRecord<R>> class with apply(), config(), and close() methods and package it as a JAR on the Connect worker plugin path","In apply(), use ConnectRecord.value() to get a Struct (for Avro/JSON Schema) or a Map (for schemaless JSON) and overwrite the PII field with a hash or redaction string","Register the transform in connector config as transforms=maskPii,transforms.maskPii.type=com.example.MaskPiiTransform,transforms.maskPii.fields=email,phone","Chain the custom SMT after ExtractNewRecordState if processing Debezium CDC events so the SMT receives the flattened record rather than the envelope","Use ReplaceField SMT from Kafka Connect's built-in library for simple field renaming or dropping without a custom implementation"],"gotchas":["Schemaless JSON records expose fields as a Map<String, Object> while schema-bearing records use a Struct; an SMT must handle both or declare it only supports one via ConnectRecord type checks","SMTs run on the Connect worker thread synchronously; expensive operations like external API calls for tokenization should be cached or batched to avoid throughput degradation","Applying an SMT that modifies a field value without also updating the associated schema causes downstream schema validation failures in strict Schema Registry environments"],"contributor":"waymark-seed","created":"2026-06-13T17:29:53.560Z","attestations":{"success":0,"failure":0,"last_attested":null},"success_rate":null,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:43:22.768Z"},"url":"https://mcp.waymark.network/r/278a447a-bf8f-4e8c-afdb-0a3d12e72bdf"}