log_event_decoder: time: plug 2038 problem on timestamp

[cosmo0920]

Fixes #11532.

On Fluent Bit core, we still have 2038 issues.
second part of flb_tm struct was processed as int32_t type and out_stdout has int32_t assumed part of printing timestamps.
So, those of operations can be truncate after 2038 cut-off of timestamps issue.
We need to fix and process after surpassed of 2038 timestamps.

After patching this, we can process until 2106 A.D logs.

---

Enter [N/A] in the box, if an item is not applicable to your change.

Testing
Before we can approve your change; please submit the following in a comment:

• Example configuration file for the change

[SERVICE]
    Flush        1
    Daemon       Off
    Log_Level    debug

[INPUT]
    Name         dummy
    Tag          test.lua
    Dummy        {"KEY_OF_TIMESTAMP":2209161600.123456,"msg":"hello-from-2040"}
    Samples      1

[FILTER]
    Name         lua
    Match        test.lua
    Script       override_time_2040.lua
    Call         override_time_2040

[OUTPUT]
    Name         stdout
    Match        test.lua

• override_time_2040.lua

function override_time_2040(tag, timestamp, record)
    return 1, record["KEY_OF_TIMESTAMP"], record
end

• Debug log output from testing the change

Fluent Bit v5.0.0
* Copyright (C) 2015-2025 The Fluent Bit Authors
* Fluent Bit is a CNCF graduated project under the Fluent organization
* https://fluentbit.io

______ _                  _    ______ _ _           _____  _____           _            
|  ___| |                | |   | ___ (_) |         |  ___||  _  |         | |           
| |_  | |_   _  ___ _ __ | |_  | |_/ /_| |_  __   _|___ \ | |/' |______ __| | _____   __
|  _| | | | | |/ _ \ '_ \| __| | ___ \ | __| \ \ / /   \ \|  /| |______/ _` |/ _ \ \ / /
| |   | | |_| |  __/ | | | |_  | |_/ / | |_   \ V //\__/ /\ |_/ /     | (_| |  __/\ V / 
\_|   |_|\__,_|\___|_| |_|\__| \____/|_|\__|   \_/ \____(_)\___/       \__,_|\___| \_/


[2026/03/13 17:05:46.416] [ info] Configuration:
[2026/03/13 17:05:46.416] [ info]  flush time     | 1.000000 seconds
[2026/03/13 17:05:46.416] [ info]  grace          | 5 seconds
[2026/03/13 17:05:46.416] [ info]  daemon         | 0
[2026/03/13 17:05:46.416] [ info] ___________
[2026/03/13 17:05:46.416] [ info]  inputs:
[2026/03/13 17:05:46.416] [ info]      dummy
[2026/03/13 17:05:46.416] [ info] ___________
[2026/03/13 17:05:46.416] [ info]  filters:
[2026/03/13 17:05:46.416] [ info]      lua.0
[2026/03/13 17:05:46.416] [ info] ___________
[2026/03/13 17:05:46.416] [ info]  outputs:
[2026/03/13 17:05:46.416] [ info]      stdout.0
[2026/03/13 17:05:46.416] [ info] ___________
[2026/03/13 17:05:46.416] [ info]  collectors:
[2026/03/13 17:05:46.417] [ info] [fluent bit] version=5.0.0, commit=748d520c05, pid=76764
[2026/03/13 17:05:46.417] [debug] [engine] coroutine stack size: 36864 bytes (36.0K)
[2026/03/13 17:05:46.417] [ info] [storage] ver=1.5.4, type=memory, sync=normal, checksum=off, max_chunks_up=128
[2026/03/13 17:05:46.417] [ info] [simd    ] NEON
[2026/03/13 17:05:46.417] [ info] [cmetrics] version=2.0.2
[2026/03/13 17:05:46.417] [ info] [ctraces ] version=0.7.0
[2026/03/13 17:05:46.417] [ info] [input:dummy:dummy.0] initializing
[2026/03/13 17:05:46.417] [ info] [input:dummy:dummy.0] storage_strategy='memory' (memory only)
[2026/03/13 17:05:46.417] [debug] [dummy:dummy.0] created event channels: read=21 write=22
[2026/03/13 17:05:46.419] [debug] [stdout:stdout.0] created event channels: read=23 write=24
[2026/03/13 17:05:46.420] [ info] [output:stdout:stdout.0] worker #0 started
[2026/03/13 17:05:46.420] [ info] [sp] stream processor started
[2026/03/13 17:05:46.420] [ info] [engine] Shutdown Grace Period=5, Shutdown Input Grace Period=2
[2026/03/13 17:05:48.423] [debug] [task] created task=0x6000000d4000 id=0 OK
[2026/03/13 17:05:48.423] [debug] [output:stdout:stdout.0] task_id=0 assigned to thread #0
[0] test.lua: [[2209161600.123456001, {}], {"KEY_OF_TIMESTAMP"=>2209161600.123456, "msg"=>"hello-from-2040"}]
[2026/03/13 17:05:48.423] [debug] [out flush] cb_destroy coro_id=0
[2026/03/13 17:05:48.423] [debug] [task] destroy task=0x6000000d4000 (task_id=0)
^C[2026/03/13 17:05:48] [engine] caught signal (SIGINT)
[2026/03/13 17:05:48.930] [ info] [input] pausing dummy.0
[2026/03/13 17:05:48.930] [ info] [output:stdout:stdout.0] thread worker #0 stopping...
[2026/03/13 17:05:48.930] [ info] [output:stdout:stdout.0] thread worker #0 stopped

• Attached Valgrind output that shows no leaks or memory corruption was found

It's not valgrind but it ran under leaks command on macOS:

Process 77148 is not debuggable. Due to security restrictions, leaks can only show or save contents of readonly memory of restricted processes.

Process:         fluent-bit [77148]
Path:            /Users/USER/*/fluent-bit
Load Address:    0x100f3c000
Identifier:      fluent-bit
Version:         0
Code Type:       ARM64
Platform:        macOS
Parent Process:  leaks [77147]
Target Type:     live task

Date/Time:       2026-03-13 17:07:32.365 +0900
Launch Time:     2026-03-13 17:07:25.318 +0900
OS Version:      macOS 15.7.4 (24G517)
Report Version:  7
Analysis Tool:   /usr/bin/leaks

Physical footprint:         4914K
Physical footprint (peak):  5026K
Idle exit:                  untracked
----

leaks Report Version: 4.0, multi-line stacks
Process 77148: 750 nodes malloced for 81 KB
Process 77148: 0 leaks for 0 total leaked bytes.

If this is a change to packaging of containers or native binaries then please confirm it works for all targets.

• Run local packaging test showing all targets (including any new ones) build.
• Set ok-package-test label to test for all targets (requires maintainer to do).

Documentation

• Documentation required for this feature

Backporting

• Backport to latest stable release.

---

Fluent Bit is licensed under Apache 2.0, by submitting this pull request I understand that this code will be released under the terms of that license.

Summary by CodeRabbit

• Bug Fixes
  • Fixed timestamp handling to correctly support dates beyond 2038.
  • Improved decoding of extended timestamp formats to preserve group markers and edge cases.
  • Updated timestamp output formatting for accurate 64-bit second values across components.
  • Strengthened validation and logging for malformed or special-case timestamps.
  • Added/updated tests to verify post-2038 timestamp behavior.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Update timestamp handling to use 64-bit seconds across the codebase: header/type changes, decoder timestamp parsing adjusted for separate sec/nsec with 64-bit semantics and group-marker handling, stdout formatting updated, and tests modified to validate post-2038 timestamps. (≤50 words)

Changes

Cohort / File(s)	Summary
Time header include/fluent-bit/flb_time.h	Added <inttypes.h> include and changed flb_time_from_double to cast seconds to int64_t for tv_sec.
Output plugin plugins/out_stdout/stdout.c	Added <inttypes.h> include and switched timestamp format specifier from PRId32 to PRId64 for log_event.timestamp.tm.tv_sec.
Decoder logic src/flb_log_event_decoder.c	Reworked EXT timestamp decoding to read separate 32-bit sec and nsec values, map special group-marker values, use 64-bit temporaries (int64_t) for timestamp handling and logging, and assign tm_nsec from nsec. Updated logging format to PRId64.
Tests tests/internal/log_event_decoder.c	Replaced a corrupted-group timestamp test: now asserts that a post-2038 timestamp (e.g., year 2040) is treated as a normal record rather than skipped.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Suggested labels

backport to v4.0.x, backport to v4.1.x

Suggested reviewers

• edsiper
• koleini
• fujimotos

Poem

🐰 I burrowed through seconds, from thirty-eight we soar,
Swapped thirty-two for sixty-four, now time is less a chore.
Group markers still hold fast, timestamps march on through,
The rabbit nods and winks — hello year 2040, woohoo! 🥕✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 20.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main objective of the PR: addressing the 2038 timestamp truncation problem by expanding timestamp handling from 32-bit to 64-bit representation across multiple components.
Linked Issues check	✅ Passed	The PR successfully addresses all coding requirements from issue #11532: changing timestamp handling from 32-bit (int32_t) to 64-bit (int64_t) in the decoder, time header, and stdout output plugin to support post-2038 timestamps.
Out of Scope Changes check	✅ Passed	All changes are directly related to fixing the 2038 timestamp problem: header includes, type conversions, and format string updates. No unrelated modifications detected in the decoder, logging, or output components.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cosmo0920-plug-2038-problem-on-timestamp

📝 Coding Plan

• Generate coding plan for human review comments

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Tip

CodeRabbit can use Clang for C/C++ static analysis and code quality checks.

Clang provides comprehensive static analysis for C and C++ code, including syntax checking, type checking, and various warning diagnostics.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3eacc86bd3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@include/fluent-bit/flb_output.h`:
- Around line 580-597: flb_output_flush_destroy currently frees the flush struct
but doesn't free the processed_event_chunk allocated by flb_output_flush_create,
causing a leak when flb_output_return isn't called (e.g., flb_pipe_w failure).
Update flb_output_flush_destroy to check for and free
out_flush->processed_event_chunk (or the actual field name used for that
allocation) before flb_free(out_flush); ensure you null the pointer after
freeing; keep existing coro cleanup intact. This mirrors the cleanup performed
in flb_output_return and prevents the leak on the early-destroy path.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 67816f29-a9eb-41f4-866c-c8154b6b5608

📥 Commits

Reviewing files that changed from the base of the PR and between a6873cd and 3c3e938.

📒 Files selected for processing (2)

• include/fluent-bit/flb_output.h
• src/flb_output.c

[patrick-stephens]

@cosmo0920 I'd probably say let's do a build of all targets just to confirm no problems anywhere but I think it's fine.

[cosmo0920]

This branch is still underdevelopment so I removed ok-package-test for now.