backport to v.3.2 -- in_tail: make read_from_head after the initial discovery optional

[emmacz]

Additionally, when a file is ignored due to ignore_older its size is stored to ensure that if the file is modified we are able to ingest the data that triggered the timestamp update.

(cherry picked from commit 7d0c4c3)

We want to backport #9490 (New in_tail's property: read_newly_discovered_files_from_head)

• Tail input plugin reads whole file from beginning when ignore_older is set to specific value #9490
  • in_tail: make read_from_head after the initial discovery optional #10227

---

Enter [N/A] in the box, if an item is not applicable to your change.

Testing
Before we can approve your change; please submit the following in a comment:

• Example configuration file for the change
• Debug log output from testing the change

To test that new property 'read_newly_discovered_files_from_head=false' works

Set read_newly_discovered_files_from_head=false to your tail plugin.

fluent-bit -i tail -p path="./app*.log" -p path_key=log_path -p Refresh_Interval=3 -p ignore_older=15m -p read_newly_discovered_files_from_head=false -p db=./db.file  -p log_level=debug  -o stdout -l fb.log -v

Simulate that files app*.log are updated, timestamp is changed one day back, new file is created as a copy of other, Fluent Bit is stopped, but harvested file is still being updated, after that only records from last known position are read. So far I can confirm that tail plugin configured as above never read the file from head!!
There are some commands, you can use to simulate harvested files changes.

#Update the file when FB is running or is down temporarily
cat <<E >>app1.log
[26-Apr-2025 14:57:04] [FluentBit works 11]
E

cp app1.log app8.log

touch -d '-10 hour' app.log
(mac) gtouch -d '-10 hour' app.log

• Attached Valgrind output that shows no leaks or memory corruption was found

If this is a change to packaging of containers or native binaries then please confirm it works for all targets.

• Run local packaging test showing all targets (including any new ones) build.
• Set ok-package-test label to test for all targets (requires maintainer to do).

Documentation

• Documentation required for this feature

Backporting

• Backport to latest stable release.

---

Fluent Bit is licensed under Apache 2.0, by submitting this pull request I understand that this code will be released under the terms of that license.

[leonardo-albertovich]

@edsiper this PR should be included in the next 3.2 release