Don't overwrite line content after a read timeout

[tobim]

📔 Description

Fix incomplete events when a timeout is hit in the middle of a line.

📝 Checklist

• All user-facing changes have changelog entries.
• The PR description contains instructions for the reviewer, if necessary.

🎯 Review Instructions

By commit. You can check before / after with:

cat conn.log | pv -L 1000 | vast import zeek

[lava]

In general while this should fix the issue where a valid line has a large pause while it is read, it looks like it symmetrically breaks the use where a line is interrupted and never completed, so the next valid line is discarded because it has junk in the beginning.

I wonder if we shouldn't have two separate timeouts for these cases, e.g. something like 30s to wait for the completion of a line and 500ms until we trigger a flush of the current table slice that was created from all finished lines.

Otherwise, if we're convinced that the first kind of error is more important to have fixed than the second kind, I'd also be ok with merging this.

[tobim]

it looks like it symmetrically breaks the use where a line is interrupted and never completed, so the next valid line is discarded because it has junk in the beginning.

From my understanding it only breaks if we hit a timeout in the middle of a line and the next data that arrives already belongs to the next line/event. I assume that to be extremely rare.

[lava]

After some external discussion it seems like the regression is an intentional trade-off, so no objections from me.