Sub-Millisecond Vector Search & Payload ACL Pre-Filtering: Announcing the Qdrant Output Connector in OpenCrawling

← Back to Blog Articles

01. Why Qdrant for Enterprise Vector Search?

As AI applications expand across enterprise ecosystems, vector storage demands extreme query throughput, low memory footprint, and strict security guarantees. While vector databases excel at similarity search, enterprise content repositories (like SharePoint, Alfresco, and Iceberg) require document-level Access Control Lists (ACLs) to ensure users only retrieve information they have explicit rights to see.

Qdrant is engineered in Rust with SIMD hardware acceleration, making it one of the fastest vector engines in existence. But what truly sets Qdrant apart for enterprise RAG is its Payload Index Engine . By supporting KEYWORD payload indexes directly alongside vector points, Qdrant allows filtering by payload attributes (such as user security SIDs) before distance calculations occur, preventing security leaks without sacrificing search performance.

Sub-Millisecond ACL Pre-Filtering: Qdrant's payload index allows OpenCrawling's McpVectorServer to inject document ACL filters directly into similarity queries, ensuring zero unauthorized vector returns.

02. Architecture & Decoupled Data Flow

The oc-qdrant-output-connector integrates directly into OpenCrawling's event-driven decoupled microservice architecture:

Decoupled Ingestion Pipeline → Qdrant Collection

Repository Connector

→

Apache Kafka

→

Tika & Token Splitter

→

oc-embedding-service

→

Qdrant Output Connector (gRPC)

Repository Ingestion: Repository connectors (Filesystem, Alfresco, Flowable, Camunda, S3) discover documents and publish lightweight claim-check messages to Kafka.

Text Extraction & Chunking: IngestionConsumer extracts clean text via Apache Tika and generates chunked payloads with associated document ACL security SIDs.

Scalable Embedding: oc-embedding-service dynamically computes vector embeddings (via Ollama or OpenAI) and pushes embedded chunks to Kafka.

High-Speed Binary Upsert: QdrantStoreWriterConsumer receives the embedded chunks and uses the gRPC Java SDK (io.qdrant:client) to upsert PointStruct batches into Qdrant over port 6334.

03. Automated Collection Provisioning & Payload ACL Indexing

Upon startup, QdrantCollectionInitializer verifies whether the configured target collection (e.g. enterprise_kb) exists. If not, it automatically provisions the collection with the desired vector dimensions and distance metric (COSINE, DOT, or EUCLID).

Simultaneously, the connector creates KEYWORD payload indexes on the security payload fields:

security_allowed_read: List of user/group SIDs permitted to access the document.

security_denied_read: Explicit deny SIDs taking precedence over allow rules.

// Example Qdrant Point Payload Structure generated by oc-qdrant-output-connector<br>"id": "c8a912e4-712d-4b92-b2fa-1092a9f1a091",<br>"vector": [0.0142, -0.0521, 0.0892, ...],<br>"payload": {<br>"text": "Enterprise quarterly financial report and forecasts...",<br>"uri": "file:///data/finance/q3_report.pdf",<br>"security_allowed_read": ["ROLE_FINANCE", "USER_S-1-5-21-3623811015"],<br>"security_denied_read": ["ROLE_EXTERN"],<br>"lastModified": "2026-07-29T18:00:00Z"

04. Configuration & Deployment

The Qdrant Output Connector is fully configurable via standard Spring Boot YAML properties or environment variables:

Property<br>Environment Variable<br>Default<br>Description

spring.opencrawling.output.qdrant.host<br>SPRING_OPENCRAWLING_OUTPUT_QDRANT_HOST<br>localhost<br>Hostname of self-hosted Qdrant or Qdrant Cloud instance

spring.opencrawling.output.qdrant.port<br>SPRING_OPENCRAWLING_OUTPUT_QDRANT_PORT<br>6334<br>High-performance gRPC port (default: 6334)

spring.opencrawling.output.qdrant.api-key<br>SPRING_OPENCRAWLING_OUTPUT_QDRANT_API_KEY<br>""<br>Optional API key for Qdrant Cloud or Enterprise cluster

spring.opencrawling.output.qdrant.collection-name<br>SPRING_OPENCRAWLING_OUTPUT_QDRANT_COLLECTION_NAME<br>enterprise_kb<br>Target Qdrant vector collection name

spring.opencrawling.output.qdrant.dimensions<br>SPRING_OPENCRAWLING_OUTPUT_QDRANT_DIMENSIONS<br>1024<br>Vector dimension size (e.g. 1024 for mxbai-embed-large)

spring.opencrawling.output.qdrant.distance<br>SPRING_OPENCRAWLING_OUTPUT_QDRANT_DISTANCE<br>COSINE<br>Vector distance metric (COSINE, DOT, EUCLID)

spring.opencrawling.output.qdrant.quantization<br>SPRING_OPENCRAWLING_OUTPUT_QDRANT_QUANTIZATION<br>NONE<br>Quantization mode (NONE, SCALAR, BINARY)

🧪<br>Automated Integration Test: You can test the end-to-end Qdrant pipeline locally with one command: ./scripts/test-qdrant-decoupled.sh. The script spins up Qdrant, Ollama, Kafka, and OpenCrawling microservices, injects a test document, and verifies point count in Qdrant.

05. Get Started Today

The Qdrant Output Connector is available starting in OpenCrawling 1.0.0-SNAPSHOT. Check out the documentation or run the Docker Compose environment to start building secure, low-latency RAG pipelines with...