in_tail: fix data loss on shutdown with buffered data

Unprocessed data in the internal buffer is currently discarded when
Fluent Bit stops, causing data loss because the DB offset is already
advanced.

This patch fixes the issue by rewinding the file offset by the remaining
buffer length on exit, ensuring the data is re-read on the next startup.

This fix only applies to non-compressed files to avoid incorrect offset
calculations with compressed streams.

Signed-off-by: jinyong.choi <[email protected]>

Author: jinyongchoi

plugins/in_tail/tail_file.c

@@ -1448,6 +1448,29 @@ void flb_tail_file_remove(struct flb_tail_file *file)
     flb_plg_debug(ctx->ins, "inode=%"PRIu64" removing file name %s",
                   file->inode, file->name);
 
+    if (file->buf_len > 0 && file->decompression_context == NULL) {
+        /*
+         * If there is data in the buffer, it means it was not processed.
+         * We must rewind the offset to ensure this data is re-read on restart.
+         */
+        off_t old_offset = file->offset;
+
+        if (file->offset > file->buf_len) {
+            file->offset -= file->buf_len;
+        } else {
+            file->offset = 0;
+        }
+
+        flb_plg_debug(ctx->ins, "inode=%"PRIu64" rewind offset for %s: old=%"PRId64" new=%"PRId64" (buf_len=%lu)",
+                      file->inode, file->name, old_offset, file->offset, (unsigned long)file->buf_len);
+
+#ifdef FLB_HAVE_SQLDB
+        if (ctx->db) {
+            flb_tail_db_file_offset(file, ctx);
+        }
+#endif        
+    }
+
     if (file->decompression_context != NULL) {
         flb_decompression_context_destroy(file->decompression_context);
     }