parser: Address wrong assignments of timezone at midnight

[cosmo0920]

Closes #11648.

---

Enter [N/A] in the box, if an item is not applicable to your change.

Testing
Before we can approve your change; please submit the following in a comment:

• Example configuration file for the change
• Debug log output from testing the change

• Attached Valgrind output that shows no leaks or memory corruption was found

If this is a change to packaging of containers or native binaries then please confirm it works for all targets.

• Run local packaging test showing all targets (including any new ones) build.
• Set ok-package-test label to test for all targets (requires maintainer to do).

Documentation

• Documentation required for this feature

Backporting

• Backport to latest stable release.

---

Fluent Bit is licensed under Apache 2.0, by submitting this pull request I understand that this code will be released under the terms of that license.

Summary by CodeRabbit

• Bug Fixes
  • Fixed timestamp parsing to correctly handle system timezone settings when processing timestamps without a year component.

[coderabbitai]

📝 Walkthrough

Walkthrough

This pull request fixes a timezone-related bug in timestamp parsing when logs contain only time information without a date. The fix modifies flb_parser_time_lookup to conditionally use local time or UTC when determining the default month/day for augmentation, based on the time_system_timezone setting. A corresponding test validates the fix.

Changes

Cohort / File(s)	Summary
Timezone-aware timestamp augmentation src/flb_parser.c	Modified flb_parser_time_lookup to use localtime_r when time_system_timezone is enabled, otherwise gmtime_r, ensuring correct date assignment for time-only log entries across timezone boundaries.
Test coverage for midnight edge case tests/internal/parser.c	Added test_parser_time_system_timezone_midnight test that validates timestamp parsing for time-only entries at midnight in Europe/Stockholm timezone, ensuring correct date attribution.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Suggested labels

backport to v4.0.x, backport to v4.1.x

Suggested reviewers

• edsiper
• leonardo-albertovich
• fujimotos

Poem

🐰 A midnight bug, now fixed with care,
When time stands still in timezones rare,
Local moments, not UTC's cold gaze,
Brings logs back home through timezone maze! ✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check	✅ Passed	The PR directly addresses issue #11648 by fixing the timezone handling logic for timestamps without year when Time_System_Timezone is enabled.
Out of Scope Changes check	✅ Passed	All changes are directly related to fixing the midnight timezone bug: conditional timezone branch in parser logic and a corresponding test case.
Title check	✅ Passed	The title accurately describes the main change: fixing timezone assignment issues at midnight when Time_System_Timezone is enabled. It directly corresponds to the code modifications in flb_parser.c that conditionally use localtime_r vs gmtime_r, and the test validating this behavior.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cosmo0920-handle-midnight-border-of-dst-jump

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (1)

tests/internal/parser.c (1)

586-588: Minor: Redundant parser destruction.

flb_parser_destroy(parser) explicitly destroys the parser and removes it from the config list. flb_parser_exit(config) then iterates remaining parsers to destroy them. Since only one parser exists and it's already destroyed, flb_parser_exit becomes a no-op for parsers (though it still calls flb_ml_exit).

You could simplify by removing line 586 and letting flb_parser_exit handle cleanup, or keep the explicit destroy if you prefer the clarity.

♻️ Optional simplification

-    flb_parser_destroy(parser);
     flb_parser_exit(config);
     flb_config_exit(config);

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@tests/internal/parser.c` around lines 586 - 588, The test currently calls
flb_parser_destroy(parser) then flb_parser_exit(config) which redundantly
attempts parser cleanup; remove the explicit flb_parser_destroy(parser) call and
let flb_parser_exit(config) (followed by flb_config_exit(config)) handle parser
teardown, or conversely keep flb_parser_destroy(parser) and remove parser
cleanup from the flb_parser_exit path—pick one approach and make the code
consistent by referencing the parser variable and the
flb_parser_exit/flb_config_exit cleanup flow accordingly.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@tests/internal/parser.c`:
- Around line 586-588: The test currently calls flb_parser_destroy(parser) then
flb_parser_exit(config) which redundantly attempts parser cleanup; remove the
explicit flb_parser_destroy(parser) call and let flb_parser_exit(config)
(followed by flb_config_exit(config)) handle parser teardown, or conversely keep
flb_parser_destroy(parser) and remove parser cleanup from the flb_parser_exit
path—pick one approach and make the code consistent by referencing the parser
variable and the flb_parser_exit/flb_config_exit cleanup flow accordingly.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: a4daaa31-5316-4039-83b9-4f002b26eff4

📥 Commits

Reviewing files that changed from the base of the PR and between 3e414ac and 6a244e1.

📒 Files selected for processing (2)

• src/flb_parser.c
• tests/internal/parser.c