in_tail: fix offset_key value multiplied by 8 on Windows 64-bit

[zshuang0316]

On Win64, FLB_LOG_EVENT_UINT64_VALUE() casts its argument to size_t * (a pointer type) to work around an MSVC varargs type-promotion bug with small constant integers. When the argument is a runtime size_t expression (stream_offset + processed_bytes), MSVC may treat the resulting size_t * differently from a plain uint64_t during varargs passing, causing the received value to be 8x the correct offset.

Fix by splitting the combined append_body_values() call into two steps: use the existing FLB_LOG_EVENT_CSTRING_VALUE macro for the key, then call flb_log_event_encoder_append_body_uint64() directly with an explicit (uint64_t) cast for the value. This avoids the variadic path entirely for the numeric offset, eliminating the Win64 MSVC issue.

---

Enter [N/A] in the box, if an item is not applicable to your change.

Testing
Before we can approve your change; please submit the following in a comment:

• [N/A] Example configuration file for the change
• [N/A] Debug log output from testing the change

• [N/A] Attached Valgrind output that shows no leaks or memory corruption was found

If this is a change to packaging of containers or native binaries then please confirm it works for all targets.

• Run local packaging test showing all targets (including any new ones) build.
• Set ok-package-test label to test for all targets (requires maintainer to do).

Documentation

• [N/A] Documentation required for this feature

Backporting

• Backport to latest stable release.

---

Fluent Bit is licensed under Apache 2.0, by submitting this pull request I understand that this code will be released under the terms of that license.

Summary by CodeRabbit

• Refactor
  • Improved internal encoding of file offset data in the tail plugin for more consistent handling.

[coderabbitai]

📝 Walkthrough

Walkthrough

The PR refactors how the offset_key field is encoded in event bodies within the tail plugin. Both flb_tail_pack_line_map() and flb_tail_file_pack_line() now append the offset_key string and its corresponding uint64 offset value using separate encoder calls instead of a single combined call.

Changes

Offset key encoding refactor

Layer / File(s)	Summary
Refactor offset_key encoding in pack functions plugins/in_tail/tail_file.c	flb_tail_pack_line_map() and flb_tail_file_pack_line() both split offset_key encoding into two calls: append the key string first, then append the uint64 offset via flb_log_event_encoder_append_body_uint64() with explicit cast, replacing the previous single flb_log_event_encoder_append_body_values() call.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• fluent/fluent-bit#10677: Both PRs modify plugins/in_tail/tail_file.c in the in_tail plugin to refactor how per-line processed byte counts are tracked and used to compute the offset_key value emitted in events.

Suggested labels

docs-required, backport to v4.0.x, backport to v4.1.x

Suggested reviewers

• edsiper
• cosmo0920
• leonardo-albertovich
• fujimotos
• koleini

Poem

🐰 The encoder hops with grace so fine,
Splitting keys from values in a line,
Two calls now bloom where one did stay,
Offset tracking finds its way! 🐇✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'in_tail: fix offset_key value multiplied by 8 on Windows 64-bit' accurately summarizes the main change: fixing a Windows 64-bit MSVC bug where offset_key values were incorrectly multiplied by 8.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}