in_systemd: add basic support for tailing logs from the last N minutes

[gersner-island]

This patch introduces the ability to tail logs from the last N minutes in the systemd input plugin. While the current read_from_tail approach works for many use cases, it can result in lost logs when it races with other components that emit logs and bootstrap at the same time.

An alternative solution using a database and cursor approach could help, but it introduces the downside of requiring a state file to be maintained.

Although systemd supports complex values for the "since" parameter, this patch simplifies the implementation by supporting only the specific use case of tailing logs from the last N minutes. This simplified approach is sufficient for many common scenarios.

---

Enter [N/A] in the box, if an item is not applicable to your change.

Testing
Before we can approve your change; please submit the following in a comment:

• Example configuration file for the change
• Debug log output from testing the change

• Attached Valgrind output that shows no leaks or memory corruption was found

If this is a change to packaging of containers or native binaries then please confirm it works for all targets.

• Run local packaging test showing all targets (including any new ones) build.
• Set ok-package-test label to test for all targets (requires maintainer to do).

Documentation

• Documentation required for this feature

Backporting

• Backport to latest stable release.

---

Fluent Bit is licensed under Apache 2.0, by submitting this pull request I understand that this code will be released under the terms of that license.

[gersner-island]

Example run bin/fluent-bit -i systemd -p Systemd_Filter=CONTAINER_NAME=sample-container -p read_since_minutes_ago=5 -o stdout -f 1.

[github-actions]

This PR is stale because it has been open 45 days with no activity. Remove stale label or comment or this will be closed in 10 days.