-
Notifications
You must be signed in to change notification settings - Fork 1.9k
Open
Description
Bug Report
Describe the bug
in_tail plugin fails to detect rotation of ignored file
To Reproduce
- Steps to reproduce the problem:
- set variable
# IGNORE_OLDER=60
# REFRESH_INTERVAL=30
- create a file for input
# echo 001 > /tmp/input.log; \
echo 002 >> /tmp/input.log
- wait for file to be ignored
# sleep $(( $IGNORE_OLDER + $REFRESH_INTERVAL + 1 ))
- rename (rotation)
# mv /tmp/input.log /tmp/input.log.1
- create a new file for input
# echo 003 >> /tmp/input.log; \
echo 004 >> /tmp/input.log; \
echo 005 >> /tmp/input.log
Expected behavior
expected output (/tmp/output.log)
{"log":"001"}
{"log":"002"}
{"log":"003"}
{"log":"004"}
{"log":"005"}
Actual results
actual output (/tmp/output.log)
{"log":"001"}
{"log":"002"}
{"log":"005"}
Your Environment
- Version used: fluent-bit-4.2.2-1.x86_64
- Configuration:
# /etc/fluent-bit/fluent-bit.conf
[SERVICE]
Flush 1
Daemon off
Log_Level debug
Parsers_file parsers.conf
[INPUT]
Name tail
Path /tmp/input.log
Read_From_Head true
read_newly_discovered_files_from_head true
Parser not_empty_line
db /tmp/input-tail.db
Ignore_Older 60
ignore_active_older_files true
refresh_interval 30
[OUTPUT]
Name file
File /tmp/output.log
Format plain
Match *
# /etc/fluent-bit/parsers.conf
[PARSER]
Name not_empty_line
Format regex
Regex ^.+$
- Environment name and version (e.g. Kubernetes? What version?): systemd 239 (239-82.el8_10.8)
- Server type and version: VM
- Operating System and version: Rocky Linux release 8.10 (Green Obsidian)
- Filters and plugins:
Additional context
when a log rotation occurs after a file has been ignored due to ignore_older and ignore_active_older_files, fluent-bit fails to detect the rotation and the size value of the previous file is carried over to the new file. Because of that, head of new file is skipped.