Investigate missing lines in Fluent Bit Tail input

Start by identifying where the missing event disappears: the source file, Tail input, parser, buffer, or destination. Enabling inotify alone is not a general fix. Fluent Bit's Linux Tail input enables Inotify_Watcher by default, and polling does not inherently skip bytes simply because an application writes quickly.

Establish a reproducible input

Use a dedicated test file, append numbered lines, and temporarily send that tag to stdout. This isolates file reading from downstream delivery:

[INPUT]
    Name              tail
    Path              /var/log/myapp/*.log
    Tag               myapp.*
    DB                /var/lib/fluent-bit/myapp.db
    Inotify_Watcher   On
    Rotate_Wait       10
    Buffer_Max_Size   256k

[OUTPUT]
    Name              stdout
    Match             myapp.*

Create the database directory with permissions for Fluent Bit's user. Give each Tail input its own database and preserve it across container recreation when offsets must survive. This example's line-size and rotation settings are starting values, not guarantees of delivery.

The Tail documentation describes the relevant settings. Inotify reports filesystem changes; it does not send one reliable notification per log line. Fluent Bit still reads the file using its tracked position. On platforms without Linux inotify, use the supported file-watching mechanism rather than treating Inotify_Watcher On as portable.

Check four common causes

• Starting position: A file without a saved offset may start at the end. Use Read_From_Head On for an intentional backfill, and understand that existing saved offsets still matter. Deleting the database can produce duplicates or omissions depending on restart settings.
• Oversized lines: Buffer_Max_Size limits the per-file read buffer. With the default long-line policy, exceeding it can stop monitoring that file. Skip_Long_Lines On continues after oversized lines by deliberately discarding them; it is not a lossless fix.
• Rotation: Allow enough Rotate_Wait for late writes to the old file. Test the application's actual rename or copy-and-truncate procedure. A file deleted before discovery or unread bytes overwritten during rotation cannot be recovered by inotify.
• Backpressure: A blocked output can pause ingestion or exhaust storage. Check retry failures, pause/resume messages, chunk limits, and free disk space. Filesystem buffering improves resilience but needs a persistent writable path and capacity planning.

On Linux, inspect fs.inotify.max_user_watches, fs.inotify.max_user_instances, and Fluent Bit's file-descriptor limit if it watches many files. Increase limits only after confirming exhaustion.

Finally, compare numbered source events with emitted and indexed events across a restart and rotation. Offset persistence records reading progress; it does not by itself prove that the destination durably stored every event.