Skip to main content

opcua

OPC UA output plugin

# Common config fields, showing default values
output:
  label: ""
  opcua:
    endpoint: "" # No default (required)
    nodeIDs: [] # No default (required)
    subscribeEnabled: false
    nodeMappings: [] # No default (required)
    handshake:
      enabled: true
      readbackTimeoutMs: 2000
      maxWriteAttempts: 1
      timeBetweenRetriesMs: 1000

The OPC UA output plugin writes data to an OPC UA server and optionally verifies the write via a read-back handshake.

Fields​

endpoint​

The OPC UA server endpoint to connect to.

Type: string

username​

The username for authentication.

Type: string
Default: ""

password​

The password for authentication.

:::caution Secret This field contains sensitive information. Use a secret reference rather than a literal value. :::

Type: string
Default: ""

sessionTimeout​

The duration in milliseconds that a OPC UA session will last. Is used to ensure that older failed sessions will timeout and that we will not get a TooManySession error.

Type: int
Default: 10000

securityMode​

The security mode to use. Leave empty to connect without encryption (only if server supports 'None').

Type: string
Default: ""

securityPolicy​

The security policy to use. Leave empty to connect without encryption (only if server supports 'None').

Type: string
Default: ""

clientCertificate​

The client certificate to use, base64-encoded.

Type: string
Default: ""

serverCertificateFingerprint​

The server certificate fingerprint to verify, SHA3-512 hash.

Type: string
Default: ""

userCertificate​

User certificate in base64 encoded format of either PEM or DER.

Type: string
Default: ""

userPrivateKey​

User private key in base64 format of PEM for user certificate based authentication.

Type: string
Default: ""

insecure​

Set to true to bypass secure connections, useful in case of SSL or certificate issues. Default is secure (false).

Type: bool
Default: false

directConnect​

Set this to true to directly connect to an OPC UA endpoint. This can be necessary in cases where the OPC UA server does not allow 'endpoint discovery'. This requires having the full endpoint name in endpoint, and securityMode and securityPolicy set.

Type: bool
Default: false

autoReconnect​

Set to true to automatically reconnect to the OPC UA server when the connection is lost.

Type: bool
Default: false

reconnectIntervalInSeconds​

The interval in seconds at which to reconnect to the OPC UA server when the connection is lost. This is only used if autoReconnect is set to true.

Type: int
Default: 5

profile​

Server profile for performance tuning. Leave empty for automatic detection (recommended).

Type: string
Default: ""

nodeIDs​

OPC UA node IDs to start browsing from.

Type: array of string

subscribeEnabled​

Set to true to subscribe to OPC UA nodes instead of fetching them every seconds. Default is pulling messages every second (false).

Type: bool
Default: false

useHeartbeat​

Set to true to provide an extra message with the servers timestamp as a heartbeat

Type: bool
Default: false

pollRate​

The rate in milliseconds at which to poll the OPC UA server when not using subscriptions. Defaults to 1000ms (1 second).

Type: int
Default: 1000

queueSize​

The size of the queue, which will get filled from the OPC UA server when requesting its data via subscription

Type: int
Default: 10

samplingInterval​

The interval for sampling on the OPC UA server - notice 0.0 will get you updates as fast as possible

Type: float
Default: 0

nodeMappings​

List of node mappings defining which message fields to write to which OPC UA nodes

Type: array of object

nodeMappings[].nodeId​

The OPC UA node ID to write to. Supports dynamic values through interpolation.

This field supports interpolation functions.

Type: string

nodeMappings[].valueFrom​

The field in the input message to get the value from.

Type: string

nodeMappings[].dataType​

The OPC UA data type for the value. Supports dynamic values through interpolation.

This field supports interpolation functions.

Type: string

handshake​

Configuration for the read-back handshake.

Type: object
Default: {"enabled":true,"maxWriteAttempts":1,"readbackTimeoutMs":2000,"timeBetweenRetriesMs":1000}

handshake.enabled​

Whether to enable read-back verification after writing.

Type: bool
Default: true

handshake.readbackTimeoutMs​

How long to wait for the server to show the updated value.

Type: int
Default: 2000

handshake.maxWriteAttempts​

Number of write attempts if the server fails.

Type: int
Default: 1

handshake.timeBetweenRetriesMs​

Delay between write attempts.

Type: int
Default: 1000

Transport security​

securityMode and securityPolicy both default to empty, and empty selects OPC UA's None mode and None policy. The session is then neither signed nor encrypted: payloads, and any username, password, or certificate exchange you configure, cross the network in clear text. It only connects at all if the server advertises a None endpoint. Treat that as a lab or bring-up setting, not a production one.

For production, set both fields to a signed-and-encrypted pair the server advertises, and provide the certificate material that pair requires:

output:
  opcua:
    endpoint: opc.tcp://plc.internal:4840
    securityMode: SignAndEncrypt      # also accepts Sign, or None
    securityPolicy: Basic256Sha256    # must be a policy the server offers
    clientCertificate: "${OPCUA_CLIENT_CERT_B64}"
    serverCertificateFingerprint: "${OPCUA_SERVER_FINGERPRINT}"
    nodeIDs: [ns=2;s=Temperature]
    nodeMappings:
      - nodeId: ns=2;s=Temperature
        valueFrom: temperature
        dataType: Double

Pinning serverCertificateFingerprint is what stops the client from trusting any certificate the endpoint happens to present, so set it whenever the mode is Sign or SignAndEncrypt.

:::caution insecure does not change connection security The field description above offers insecure as a way to bypass secure connections when SSL or certificates are the problem. It does not do that. The field is accepted, but setting it neither relaxes certificate checking nor rescues a failing handshake, so treat the description as the one place on this page not to follow. Fix the certificate configuration instead, or connect to a None endpoint deliberately through securityMode and securityPolicy. :::