Hello Sikka, > If consumer restarts (app crash, bounce etc.) after dynamically adding > partitions > it would consume unread messages from last committed offset for existing > partitions but would still miss the messages from new partition.
For dynamic consumers, a restart inherently means leaving and rejoining the group as a new member, so recalculating startupTimestamp = now() is semantically correct — the consumer is genuinely starting fresh. The gap you described only applies to static membership, where the consumer can restart without triggering a rebalance, yet the local timestamp still gets reset. For this scenario, as Chia suggested, we could extend the configuration to accept an explicit timestamp This would allow users to pin a fixed reference point across restarts, effectively closing the gap for static membership. For dynamic consumers, the default by_start_time without an explicit timestamp already provides the correct behavior and a significant improvement over latest, which would miss data even without a restart. > If the offset are deleted mention in mentioned in Scenario 2 (Log truncation) > how this solution would address that scenario ? For the log truncation scenario, when segments are deleted and the consumer's committed offset becomes out of range, auto.offset.reset is triggered. With latest, the consumer simply jumps to the end of the partition, skipping all remaining available data. With by_start_time, the consumer looks up the position based on the startup timestamp rather than relying on offsets. Since the lookup is timestamp-based, it is not affected by offset invalidation due to truncation. Any data with timestamps at or after the startup time will still be found and consumed. > Do we need to care about Clock Skew or SystemTime Issues on consumer client > side. > Should we use timestamp on the server/broker side ? Clock skew is a fair concern, but using a server-side timestamp does not necessarily make things safer. It would mean comparing the Group Coordinator's time against the Partition Leader's time, which are often different nodes. Without strict clock synchronization across the Kafka cluster, this "happens-before" relationship remains fundamentally unpredictable. On the other hand, auto.offset.reset is strictly a client-level configuration — consumers within the same group can intentionally use different policies. Tying the timestamp to a global server-side state would be a semantic mismatch. A local timestamp aligns much better with the client-level nature of this config. > Do you plan to have any metrics or observability when consumer resets offset > by_start_time That's a great suggestion. I plan to expose the startup timestamp used by by_start_time as a client-level metric, so users can easily verify which reference point the consumer is using during debugging. Best Regards, Jiunn-Yang > Chia-Ping Tsai <[email protected]> 於 2026年3月6日 晚上10:44 寫道： > > Hi Ryan, > > That is a fantastic point. A static member restarting and capturing a newer > local timestamp is definitely a critical edge case. > > Since users already need to inject a unique group.instance.id into the > configuration for static members, my idea is to allow the auto.offset.reset > policy to carry a dedicated timestamp to explicitly "lock" the startup time > (for example, using a format like auto.offset.reset=startup:<timestamp>). > > This means that if users want to leverage this new policy with static > membership, their deployment configuration would simply include these two > specific injected values (the static ID and the locked timestamp). > > This approach elegantly maintains the configuration semantics at the > member-level, and most importantly, it avoids any need to update the RPC > protocol. > > What do you think of this approach for the static membership scenario? > > On 2026/03/05 19:45:13 "Ryan Leslie (BLOOMBERG/ NEW YORK)" wrote: >> Hey Jiunn, >> >> Glad to see some progress around this issue. >> >> I had a similar thought to David, that if the time is only known client side >> there are still edge cases for data loss. One case is static membership >> where from the perspective of a client they are free to restart their >> consumer task without actually having left or meaningfully affected the >> group. However, I think with the proposed implementation the timestamp is >> still reset here. So if the restart happens just after a partition is added >> and published to, but before the consumer metadata refreshed, the group >> still runs the risk of data loss. >> >> It could be argued that keeping the group 'stable' is a requirement for this >> feature to work, but sometimes it's not possible to accomplish. >> >> From: [email protected] At: 03/05/26 14:32:20 UTC-5:00To: >> [email protected] >> Subject: Re: [DISCUSS] KIP-1282: Prevent data loss during partition >> expansion for dynamically added partitions >> >> Hi Jiunn, >> >> Thanks for the KIP! >> >> I was also considering this solution while we discussed in the jira. It >> seems to work in most of the cases but not in all. For instance, let’s >> imagine a partition created just before a new consumer joins or rejoins the >> group and this consumer gets the new partition. In this case, the consumer >> will have a start time which is older than the partition creation time. >> This could also happen with the truncation case. It makes the behavior kind >> of unpredictable again. >> >> Instead of relying on a local timestamp, one idea would to rely on a >> timestamp provided by the server. For instance, we could define the time >> since the group became non-empty. This would define the subscription time >> for the consumer group. The downside is that it only works if the consumer >> is part of a group. >> >> In your missing semantic section, I don’t fully understand how the 4th >> point is improved by the KIP. It says start from earliest but with the >> change it would start from application start time. Could you elaborate? >> >> Best, >> David >> >> Le jeu. 5 mars 2026 à 12:47, 黃竣陽 <[email protected]> a écrit : >> >>> Hello chia, >>> >>> Thanks for your feedback, I have updated the KIP. >>> >>> Best Regards, >>> Jiunn-Yang >>> >>>> Chia-Ping Tsai <[email protected]> 於 2026年3月5日 晚上7:24 寫道： >>>> >>>> hi Jiunn >>>> >>>> chia_00: Would you mind mentioning KAFKA-19236 in the KIP? It would be >>> helpful to let readers know that "Dynamically at partition discovery" is >>> being tracked as a separate issue >>>> >>>> Best, >>>> Chia-Ping >>>> >>>> On 2026/03/05 11:14:31 黃竣陽 wrote: >>>>> Hello everyone, >>>>> >>>>> I would like to start a discussion on KIP-1282: Prevent data loss >>> during partition expansion for dynamically added partitions >>>>> <https://cwiki.apache.org/confluence/x/mIY8G> >>>>> >>>>> This proposal aims to introduce a new auto.offset.reset policy >>> by_start_time, anchoring the >>>>> offset reset to the consumer's startup timestamp rather than partition >>> discovery time, to prevent >>>>> silent data loss during partition expansion. >>>>> >>>>> Best regards, >>>>> Jiunn-Yang >>> >>> >> >> >>
