fluentd 1.11.5-x86-mingw32 → 1.12.0-x86-mingw32

data/lib/fluent/command/ctl.rb

@@ -0,0 +1,177 @@
+#
+# Fluentd
+#
+#    Licensed under the Apache License, Version 2.0 (the "License");
+#    you may not use this file except in compliance with the License.
+#    You may obtain a copy of the License at
+#
+#        http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS,
+#    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#    See the License for the specific language governing permissions and
+#    limitations under the License.
+#
+
+require 'optparse'
+require 'fluent/env'
+require 'fluent/version'
+if Fluent.windows?
+  require 'win32/event'
+  require 'win32/service'
+end
+
+module Fluent
+  class Ctl
+    DEFAULT_OPTIONS = {}
+
+    if Fluent.windows?
+      include Windows::ServiceConstants
+      include Windows::ServiceStructs
+      include Windows::ServiceFunctions
+
+      COMMAND_MAP = {
+        shutdown: "",
+        restart: "HUP",
+        flush: "USR1",
+        reload: "USR2",
+      }
+      WINSVC_CONTROL_CODE_MAP = {
+        shutdown: SERVICE_CONTROL_STOP,
+        # 128 - 255: user-defined control code
+        # See https://docs.microsoft.com/en-us/windows/win32/api/winsvc/nf-winsvc-controlservice
+        restart: 128,
+        flush: 129,
+        reload: SERVICE_CONTROL_PARAMCHANGE,
+      }
+    else
+      COMMAND_MAP = {
+        shutdown: :TERM,
+        restart: :HUP,
+        flush: :USR1,
+        reload: :USR2,
+      }
+    end
+
+    def initialize(argv = ARGV)
+      @argv = argv
+      @options = {}
+      @opt_parser = OptionParser.new
+      configure_option_parser
+      @options.merge!(DEFAULT_OPTIONS)
+      parse_options!
+    end
+
+    def help_text
+      text = "\n"
+      if Fluent.windows?
+        text << "Usage: #{$PROGRAM_NAME} COMMAND [PID_OR_SVCNAME]\n"
+      else
+        text << "Usage: #{$PROGRAM_NAME} COMMAND PID\n"
+      end
+      text << "\n"
+      text << "Commands: \n"
+      COMMAND_MAP.each do |key, value|
+        text << "  #{key}\n"
+      end
+      text
+    end
+
+    def usage(msg = nil)
+      puts help_text
+      if msg
+        puts
+        puts "Error: #{msg}"
+      end
+      exit 1
+    end
+
+    def call
+      if Fluent.windows?
+        if @pid_or_svcname =~ /^[0-9]+$/
+          # Use as PID
+          return call_windows_event(@command, "fluentd_#{@pid_or_svcname}")
+        end
+
+        unless call_winsvc_control_code(@command, @pid_or_svcname)
+          puts "Cannot send control code to #{@pid_or_svcname} service, try to send an event with this name ..."
+          call_windows_event(@command, @pid_or_svcname)
+        end
+      else
+        call_signal(@command, @pid_or_svcname)
+      end
+    end
+
+    private
+
+    def call_signal(command, pid)
+      signal = COMMAND_MAP[command.to_sym]
+      Process.kill(signal, pid.to_i)
+    end
+
+    def call_winsvc_control_code(command, pid_or_svcname)
+      status = SERVICE_STATUS.new
+
+      begin
+        handle_scm = OpenSCManager(nil, nil, SC_MANAGER_CONNECT)
+        FFI.raise_windows_error('OpenSCManager') if handle_scm == 0
+
+        handle_scs = OpenService(handle_scm, "fluentdwinsvc", SERVICE_STOP | SERVICE_PAUSE_CONTINUE | SERVICE_USER_DEFINED_CONTROL)
+        FFI.raise_windows_error('OpenService') if handle_scs == 0
+
+        control_code = WINSVC_CONTROL_CODE_MAP[command.to_sym]
+
+        unless ControlService(handle_scs, control_code, status)
+          FFI.raise_windows_error('ControlService')
+        end
+      rescue => e
+        puts e
+        state = status[:dwCurrentState]
+        return state == SERVICE_STOPPED || state == SERVICE_STOP_PENDING
+      ensure
+        CloseServiceHandle(handle_scs)
+        CloseServiceHandle(handle_scm)
+      end
+
+      return true
+    end
+
+    def call_windows_event(command, pid_or_svcname)
+      prefix = pid_or_svcname
+      event_name = COMMAND_MAP[command.to_sym]
+      suffix = event_name.empty? ? "" : "_#{event_name}"
+
+      begin
+        event = Win32::Event.open("#{prefix}#{suffix}")
+        event.set
+        event.close
+      rescue Errno::ENOENT => e
+        puts "Error: Cannot find the fluentd process with the event name: \"#{prefix}\""
+      end
+    end
+
+    def configure_option_parser
+      @opt_parser.banner = help_text
+      @opt_parser.version = Fluent::VERSION
+    end
+
+    def parse_options!
+      @opt_parser.parse!(@argv)
+
+      @command = @argv[0]
+      @pid_or_svcname = @argv[1] || "fluentdwinsvc"
+
+      usage("Command isn't specified!") if @command.nil? || @command.empty?
+      usage("Unknown command: #{@command}") unless COMMAND_MAP.has_key?(@command.to_sym)
+
+      if Fluent.windows?
+        usage("PID or SVCNAME isn't specified!") if @pid_or_svcname.nil? || @pid_or_svcname.empty?
+      else
+        usage("PID isn't specified!") if @pid_or_svcname.nil? || @pid_or_svcname.empty?
+        usage("Invalid PID: #{pid}") unless @pid_or_svcname =~ /^[0-9]+$/
+      end
+    end
+  end
+end
+

data/lib/fluent/command/plugin_config_formatter.rb

@@ -29,7 +29,8 @@ class FluentPluginConfigFormatter
   AVAILABLE_FORMATS = [:markdown, :txt, :json]
   SUPPORTED_TYPES = [
     "input", "output", "filter",
-    "buffer", "parser", "formatter", "storage"
+    "buffer", "parser", "formatter", "storage",
+    "service_discovery"
   ]
 
   DOCS_BASE_URL = "https://docs.fluentd.org/v/1.0"

data/lib/fluent/env.rb

@@ -28,4 +28,8 @@ module Fluent
   def self.windows?
     ServerEngine.windows?
   end
+
+  def self.linux?
+    /linux/ === RUBY_PLATFORM
+  end
 end

data/lib/fluent/plugin.rb

@@ -121,6 +121,11 @@ module Fluent
       new_impl('sd', SD_REGISTRY, type, parent)
     end
 
+    class << self
+      # This should be defined for fluent-plugin-config-formatter type arguments.
+      alias_method :new_service_discovery, :new_sd
+    end
+
     def self.new_parser(type, parent: nil)
       if type[0] == '/' && type[-1] == '/'
         # This usage is not recommended for new API... create RegexpParser directly

data/lib/fluent/plugin/buffer.rb

@@ -143,33 +143,14 @@ module Fluent
           end
         end
 
-        # timekey should be unixtime as usual.
-        # So, unixtime should be bigger than 2^30 - 1 (= 1073741823) nowadays.
-        # We should check object_id stability to use object_id as optimization for comparing operations.
-        # e.g.)
-        # irb> Time.parse("2020/07/31 18:30:00+09:00").to_i
-        # => 1596187800
-        # irb> Time.parse("2020/07/31 18:30:00+09:00").to_i > 2**30 -1
-        # => true
-        def self.enable_optimize?
-          a1 = 2**30 - 1
-          a2 = 2**30 - 1
-          b1 = 2**62 - 1
-          b2 = 2**62 - 1
-          (a1.object_id == a2.object_id) && (b1.object_id == b2.object_id)
-        end
-
         # This is an optimization code. Current Struct's implementation is comparing all data.
         # https://github.com/ruby/ruby/blob/0623e2b7cc621b1733a760b72af246b06c30cf96/struct.c#L1200-L1203
         # Actually this overhead is very small but this class is generated *per chunk* (and used in hash object).
         # This means that this class is one of the most called object in Fluentd.
         # See https://github.com/fluent/fluentd/pull/2560
-        # But, this optimization has a side effect on Windows and 32bit environment(s) due to differing object_id.
-        # This difference causes flood of buffer files.
-        # So, this optimization should be enabled on `enable_optimize?` as true platforms.
         def hash
-          timekey.object_id
-        end if enable_optimize?
+          timekey.hash
+        end
       end
 
       # for tests

data/lib/fluent/plugin/formatter.rb

@@ -63,9 +63,9 @@ module Fluent
           super
           @newline = case newline
                      when :lf
-                       "\n"
+                       "\n".freeze
                      when :crlf
-                       "\r\n"
+                       "\r\n".freeze
                      end
         end
       end

data/lib/fluent/plugin/formatter_csv.rb

@@ -27,7 +27,7 @@ module Fluent
       helpers :record_accessor
 
       config_param :delimiter, default: ',' do |val|
-        ['\t', 'TAB'].include?(val) ? "\t" : val
+        ['\t', 'TAB'].include?(val) ? "\t".freeze : val.freeze
       end
       config_param :force_quotes, :bool, default: true
       # "array" looks good for type of :fields, but this implementation removes tailing comma

data/lib/fluent/plugin/formatter_hash.rb

@@ -27,7 +27,7 @@ module Fluent
 
       def format(tag, time, record)
         line = record.to_s
-        line << @newline.freeze if @add_newline
+        line << @newline if @add_newline
         line
       end
     end

data/lib/fluent/plugin/formatter_ltsv.rb

@@ -25,8 +25,8 @@ module Fluent
 
       # http://ltsv.org/
 
-      config_param :delimiter, :string, default: "\t"
-      config_param :label_delimiter, :string, default: ":"
+      config_param :delimiter, :string, default: "\t".freeze
+      config_param :label_delimiter, :string, default: ":".freeze
       config_param :add_newline, :bool, default: true
 
       # TODO: escaping for \t in values
@@ -36,7 +36,7 @@ module Fluent
           formatted << @delimiter if formatted.length.nonzero?
           formatted << "#{label}#{@label_delimiter}#{value}"
         end
-        formatted << @newline.freeze if @add_newline
+        formatted << @newline if @add_newline
         formatted
       end
     end

data/lib/fluent/plugin/formatter_out_file.rb

@@ -29,9 +29,9 @@ module Fluent
       config_param :output_tag, :bool, default: true
       config_param :delimiter, default: "\t" do |val|
         case val
-        when /SPACE/i then ' '
-        when /COMMA/i then ','
-        else "\t"
+        when /SPACE/i then ' '.freeze
+        when /COMMA/i then ','.freeze
+        else "\t".freeze
         end
       end
       config_set_default :time_type, :string

data/lib/fluent/plugin/formatter_single_value.rb

@@ -23,12 +23,12 @@ module Fluent
 
       Plugin.register_formatter('single_value', self)
 
-      config_param :message_key, :string, default: 'message'
+      config_param :message_key, :string, default: 'message'.freeze
       config_param :add_newline, :bool, default: true
 
       def format(tag, time, record)
         text = record[@message_key].to_s.dup
-        text << @newline.freeze if @add_newline
+        text << @newline if @add_newline
         text
       end
     end

data/lib/fluent/plugin/formatter_tsv.rb

@@ -26,13 +26,13 @@ module Fluent
       desc 'Field names included in each lines'
       config_param :keys, :array, value_type: :string
       desc 'The delimiter character (or string) of TSV values'
-      config_param :delimiter, :string, default: "\t"
+      config_param :delimiter, :string, default: "\t".freeze
       desc 'The parameter to enable writing to new lines'
       config_param :add_newline, :bool, default: true
 
       def format(tag, time, record)
         formatted = @keys.map{|k| record[k].to_s }.join(@delimiter)
-        formatted << @newline.freeze if @add_newline
+        formatted << @newline if @add_newline
         formatted
       end
     end

data/lib/fluent/plugin/in_http.rb

@@ -80,6 +80,8 @@ module Fluent::Plugin
     config_param :use_204_response, :bool, default: false
     desc 'Dump error log or not'
     config_param :dump_error_log, :bool, default: true
+    desc 'Add QUERY_ prefix query params to record'
+    config_param :add_query_params, :bool, default: false
 
     config_section :parse do
       config_set_default :@type, 'in_http'
@@ -277,7 +279,7 @@ module Fluent::Plugin
     private
 
     def on_server_connect(conn)
-      handler = Handler.new(conn, @km, method(:on_request), @body_size_limit, @format_name, log, @cors_allow_origins)
+      handler = Handler.new(conn, @km, method(:on_request), @body_size_limit, @format_name, log, @cors_allow_origins, @add_query_params)
 
       conn.on(:data) do |data|
         handler.on_read(data)
@@ -326,6 +328,14 @@ module Fluent::Plugin
         }
       end
 
+      if @add_query_params
+        params.each_pair { |k, v|
+          if k.start_with?("QUERY_".freeze)
+            record[k] = v
+          end
+        }
+      end
+
       if @add_remote_addr
         record['REMOTE_ADDR'] = params['REMOTE_ADDR']
       end
@@ -346,7 +356,7 @@ module Fluent::Plugin
     class Handler
       attr_reader :content_type
 
-      def initialize(io, km, callback, body_size_limit, format_name, log, cors_allow_origins)
+      def initialize(io, km, callback, body_size_limit, format_name, log, cors_allow_origins, add_query_params)
         @io = io
         @km = km
         @callback = callback
@@ -356,6 +366,7 @@ module Fluent::Plugin
         @log = log
         @cors_allow_origins = cors_allow_origins
         @idle = 0
+        @add_query_params = add_query_params
         @km.add(self)
 
         @remote_port, @remote_addr = io.remote_port, io.remote_addr
@@ -533,7 +544,17 @@ module Fluent::Plugin
         end
         path_info = uri.path
 
+        if (@add_query_params) 
+
+          query_params = WEBrick::HTTPUtils.parse_query(uri.query)
+
+          query_params.each_pair {|k,v|
+            params["QUERY_#{k.gsub('-','_').upcase}"] = v
+          }
+        end
+
         params.merge!(@env)
+
         @env.clear
 
         code, header, body = @callback.call(path_info, params)

data/lib/fluent/plugin/in_tail.rb

@@ -22,6 +22,7 @@ require 'fluent/event'
 require 'fluent/plugin/buffer'
 require 'fluent/plugin/parser_multiline'
 require 'fluent/variable_store'
+require 'fluent/capability'
 require 'fluent/plugin/in_tail/position_file'
 
 if Fluent.windows?
@@ -104,6 +105,8 @@ module Fluent::Plugin
     config_param :ignore_repeated_permission_error, :bool, default: false
     desc 'Format path with the specified timezone'
     config_param :path_timezone, :string, default: nil
+    desc 'Follow inodes instead of following file names. Guarantees more stable delivery and allows to use * in path pattern with rotating files'
+    config_param :follow_inodes, :bool, default: false
 
     config_section :parse, required: false, multi: true, init: true, param_name: :parser_configs do
       config_argument :usage, :string, default: 'in_tail_parser'
@@ -154,6 +157,9 @@ module Fluent::Plugin
         end
         @variable_store[@pos_file] = self.plugin_id
       else
+        if @follow_inodes
+          raise Fluent::ConfigError, "Can't follow inodes without pos_file configuration parameter"
+        end
         $log.warn "'pos_file PATH' parameter is not set to a 'tail' source."
         $log.warn "this parameter is highly recommended to save the position to resume tailing."
       end
@@ -171,6 +177,7 @@ module Fluent::Plugin
       @dir_perm = system_config.dir_permission || Fluent::DEFAULT_DIR_PERMISSION
       # parser is already created by parser helper
       @parser = parser_create(usage: parser_config['usage'] || @parser_configs.first.usage)
+      @capability = Fluent::Capability.new(:current_process)
     end
 
     def configure_tag
@@ -214,7 +221,7 @@ module Fluent::Plugin
         FileUtils.mkdir_p(pos_file_dir, mode: @dir_perm) unless Dir.exist?(pos_file_dir)
         @pf_file = File.open(@pos_file, File::RDWR|File::CREAT|File::BINARY, @file_perm)
         @pf_file.sync = true
-        @pf = PositionFile.load(@pf_file, logger: log)
+        @pf = PositionFile.load(@pf_file, @follow_inodes, expand_paths, logger: log)
 
         if @pos_file_compaction_interval
           timer_execute(:in_tail_refresh_compact_pos_file, @pos_file_compaction_interval) do
@@ -238,7 +245,7 @@ module Fluent::Plugin
 
     def shutdown
       # during shutdown phase, don't close io. It should be done in close after all threads are stopped. See close.
-      stop_watchers(@tails.keys, immediate: true, remove_watcher: false)
+      stop_watchers(existence_path, immediate: true, remove_watcher: false)
       @pf_file.close if @pf_file
 
       super
@@ -250,6 +257,11 @@ module Fluent::Plugin
       close_watcher_handles
     end
 
+    def have_read_capability?
+      @capability.have_capability?(:effective, :dac_read_search) ||
+        @capability.have_capability?(:effective, :dac_override)
+    end
+
     def expand_paths
       date = Fluent::EventTime.now
       paths = []
@@ -263,7 +275,7 @@ module Fluent::Plugin
           paths += Dir.glob(path).select { |p|
             begin
               is_file = !File.directory?(p)
-              if File.readable?(p) && is_file
+              if (File.readable?(p) || have_read_capability?) && is_file
                 if @limit_recently_modified && File.mtime(p) < (date.to_time - @limit_recently_modified)
                   false
                 else
@@ -296,7 +308,31 @@ module Fluent::Plugin
                end
         path.include?('*') ? Dir.glob(path) : path
       }.flatten.uniq
-      paths.uniq - excluded
+      # filter out non existing files, so in case pattern is without '*' we don't do unnecessary work
+      hash = {}
+      (paths - excluded).select { |path|
+        FileTest.exist?(path)
+      }.each { |path|
+        target_info = TargetInfo.new(path, Fluent::FileWrapper.stat(path).ino)
+        if @follow_inodes
+          hash[target_info.ino] = target_info
+        else
+          hash[target_info.path] = target_info
+        end
+      }
+      hash
+    end
+
+    def existence_path
+      hash = {}
+      @tails.each_key {|target_info|
+        if @follow_inodes
+          hash[target_info.ino] = target_info
+        else
+          hash[target_info.path] = target_info
+        end
+      }
+      hash
     end
 
     # in_tail with '*' path doesn't check rotation file equality at refresh phase.
@@ -305,21 +341,21 @@ module Fluent::Plugin
     # In such case, you should separate log directory and specify two paths in path parameter.
     # e.g. path /path/to/dir/*,/path/to/rotated_logs/target_file
     def refresh_watchers
-      target_paths = expand_paths
-      existence_paths = @tails.keys
+      target_paths_hash = expand_paths
+      existence_paths_hash = existence_path
 
       log.debug { "tailing paths: target = #{target_paths.join(",")} | existing = #{existence_paths.join(",")}" }
 
-      unwatched = existence_paths - target_paths
-      added = target_paths - existence_paths
+      unwatched_hash = existence_paths_hash.reject {|key, value| target_paths_hash.key?(key)}
+      added_hash = target_paths_hash.reject {|key, value| existence_paths_hash.key?(key)}
 
-      stop_watchers(unwatched, immediate: false, unwatched: true) unless unwatched.empty?
-      start_watchers(added) unless added.empty?
+      stop_watchers(unwatched_hash, immediate: false, unwatched: true) unless unwatched_hash.empty?
+      start_watchers(added_hash) unless added_hash.empty?
     end
 
-    def setup_watcher(path, pe)
+    def setup_watcher(target_info, pe)
       line_buffer_timer_flusher = @multiline_mode ? TailWatcher::LineBufferTimerFlusher.new(log, @multiline_flush_interval, &method(:flush_buffer)) : nil
-      tw = TailWatcher.new(path, pe, log, @read_from_head, method(:update_watcher), line_buffer_timer_flusher, method(:io_handler))
+      tw = TailWatcher.new(target_info, pe, log, @read_from_head, @follow_inodes, method(:update_watcher), line_buffer_timer_flusher, method(:io_handler))
 
       if @enable_watch_timer
         tt = TimerTrigger.new(1, log) { tw.on_notify }
@@ -350,47 +386,52 @@ module Fluent::Plugin
       raise e
     end
 
-    def start_watchers(paths)
-      paths.each { |path|
+    def start_watchers(targets_info)
+      targets_info.each_value { |target_info|
         pe = nil
         if @pf
-          pe = @pf[path]
+          pe = @pf[target_info]
           if @read_from_head && pe.read_inode.zero?
             begin
-              pe.update(Fluent::FileWrapper.stat(path).ino, 0)
+              pe.update(Fluent::FileWrapper.stat(target_info.path).ino, 0)
             rescue Errno::ENOENT
-              $log.warn "#{path} not found. Continuing without tailing it."
+              $log.warn "#{target_info.path} not found. Continuing without tailing it."
             end
           end
         end
 
         begin
-          tw = setup_watcher(path, pe)
+          tw = setup_watcher(target_info, pe)
         rescue WatcherSetupError => e
-          log.warn "Skip #{path} because unexpected setup error happens: #{e}"
+          log.warn "Skip #{target_info.path} because unexpected setup error happens: #{e}"
           next
         end
-        @tails[path] = tw
+        target_info = TargetInfo.new(target_info.path, Fluent::FileWrapper.stat(target_info.path).ino)
+        @tails[target_info] = tw
       }
     end
 
-    def stop_watchers(paths, immediate: false, unwatched: false, remove_watcher: true)
-      paths.each { |path|
-        tw = remove_watcher ? @tails.delete(path) : @tails[path]
+    def stop_watchers(targets_info, immediate: false, unwatched: false, remove_watcher: true)
+      targets_info.each_value { |target_info|
+        if remove_watcher
+          tw = @tails.delete(target_info)
+        else
+          tw = @tails[target_info]
+        end
         if tw
           tw.unwatched = unwatched
           if immediate
-            detach_watcher(tw, false)
+            detach_watcher(tw, target_info.ino, false)
           else
-            detach_watcher_after_rotate_wait(tw)
+            detach_watcher_after_rotate_wait(tw, target_info.ino)
           end
         end
       }
     end
 
     def close_watcher_handles
-      @tails.keys.each do |path|
-        tw = @tails.delete(path)
+      @tails.keys.each do |target_info|
+        tw = @tails.delete(target_info)
         if tw
           tw.close
         end
@@ -398,25 +439,39 @@ module Fluent::Plugin
     end
 
     # refresh_watchers calls @tails.keys so we don't use stop_watcher -> start_watcher sequence for safety.
-    def update_watcher(path, pe)
-      log.info("detected rotation of #{path}; waiting #{@rotate_wait} seconds")
+    def update_watcher(target_info, pe)
+      log.info("detected rotation of #{target_info.path}; waiting #{@rotate_wait} seconds")
 
       if @pf
-        unless pe.read_inode == @pf[path].read_inode
+        pe_inode = pe.read_inode
+        target_info_from_position_entry = TargetInfo.new(target_info.path, pe_inode)
+        unless pe_inode == @pf[target_info_from_position_entry].read_inode
           log.debug "Skip update_watcher because watcher has been already updated by other inotify event"
           return
         end
       end
-      rotated_tw = @tails[path]
-      @tails[path] = setup_watcher(path, pe)
-      detach_watcher_after_rotate_wait(rotated_tw) if rotated_tw
+
+      rotated_target_info = TargetInfo.new(target_info.path, pe.read_inode)
+      rotated_tw = @tails[rotated_target_info]
+      new_target_info = target_info.dup
+
+      if @follow_inodes
+        new_position_entry = @pf[target_info]
+
+        if new_position_entry.read_inode == 0
+          @tails[new_target_info] = setup_watcher(new_target_info, new_position_entry)
+        end
+      else
+        @tails[new_target_info] = setup_watcher(new_target_info, pe)
+      end
+      detach_watcher_after_rotate_wait(rotated_tw, pe.read_inode) if rotated_tw
     end
 
     # TailWatcher#close is called by another thread at shutdown phase.
     # It causes 'can't modify string; temporarily locked' error in IOHandler
     # so adding close_io argument to avoid this problem.
     # At shutdown, IOHandler's io will be released automatically after detached the event loop
-    def detach_watcher(tw, close_io = true)
+    def detach_watcher(tw, ino, close_io = true)
       tw.watchers.each do |watcher|
         event_loop_detach(watcher)
       end
@@ -425,15 +480,16 @@ module Fluent::Plugin
       tw.close if close_io
 
       if tw.unwatched && @pf
-        @pf.unwatch(tw.path)
+        target_info = TargetInfo.new(tw.path, ino)
+        @pf.unwatch(target_info)
       end
     end
 
-    def detach_watcher_after_rotate_wait(tw)
+    def detach_watcher_after_rotate_wait(tw, ino)
       # Call event_loop_attach/event_loop_detach is high-cost for short-live object.
       # If this has a problem with large number of files, use @_event_loop directly instead of timer_execute.
       timer_execute(:in_tail_close_watcher, @rotate_wait, repeat: false) do
-        detach_watcher(tw)
+        detach_watcher(tw, ino)
       end
     end
 
@@ -601,10 +657,12 @@ module Fluent::Plugin
     end
 
     class TailWatcher
-      def initialize(path, pe, log, read_from_head, update_watcher, line_buffer_timer_flusher, io_handler_build)
-        @path = path
+      def initialize(target_info, pe, log, read_from_head, follow_inodes, update_watcher, line_buffer_timer_flusher, io_handler_build)
+        @path = target_info.path
+        @ino = target_info.ino
         @pe = pe || MemoryPositionEntry.new
         @read_from_head = read_from_head
+        @follow_inodes = follow_inodes
         @update_watcher = update_watcher
         @log = log
         @rotate_handler = RotateHandler.new(log, &method(:on_rotate))
@@ -614,7 +672,7 @@ module Fluent::Plugin
         @watchers = []
       end
 
-      attr_reader :path
+      attr_reader :path, :ino
       attr_reader :pe
       attr_reader :line_buffer_timer_flusher
       attr_accessor :unwatched  # This is used for removing position entry from PositionFile
@@ -709,7 +767,17 @@ module Fluent::Plugin
           end
 
           if watcher_needs_update
-            @update_watcher.call(@path, swap_state(@pe))
+            # No need to update a watcher if stat is nil (file not present), because moving to inodes will create
+            # new watcher, and old watcher will be closed by stop_watcher in refresh_watchers method
+            if stat
+              target_info = TargetInfo.new(@path, stat.ino)
+              if @follow_inodes
+                # don't want to swap state because we need latest read offset in pos file even after rotate_wait
+                @update_watcher.call(target_info, @pe)
+              else
+                @update_watcher.call(target_info, swap_state(@pe))
+              end
+            end
           else
             @log.info "detected rotation of #{@path}"
             @io_handler = io_handler