<p>If the max-file value is set to 2, two files are created as shown below.</p>

<pre><code>11111-json.log
11111-json.log.1
</code></pre>

<p>But here, when the <code>11111-json.log</code> file size is <code>max-size</code>, the contents of <code>11111-json.log</code> are moved to <code>11111-json.log.1</code>, and the size of <code>11111-json.log</code> Becomes zero.
/var/log/container 
At this point I lose the last log.</p>

<p>The log in the <code>/var/log/container</code> path eventually links to <code>/var/lib/docker/containers/~</code>, so if the file mentioned above works that way, the log will be lost.</p>

<p>How can't I be lost?</p>

<p>According to your settings, all logs .log.1, .log.2 are stored in /var/lib/docker/containers/... and as per docker documentation you can change those settings for docker in <a href="https://docs.docker.com/config/containers/logging/configure/" rel="nofollow noreferrer">daemon.json</a>: </p>

<pre><code> "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "3",
</code></pre>

<p>in /var/log/containers you can find link to the last created log file.</p>

<p>As per documentation for <a href="https://docs.fluentd.org/input/tail#example-configuration" rel="nofollow noreferrer">flunetd</a>:
You should consider using <strong>in_tail</strong> option: </p>

<blockquote>
  <p>in_tail is included in Fluentd's core. No additional installation process is required.
  When Fluentd is first configured with in_tail, it will start reading from the tail of that log, not the beginning. Once the log is rotated, Fluentd starts reading the new file from the beginning. It keeps track of the current inode number.</p>
</blockquote>

<p>Please refer to the similar <a href="https://stackoverflow.com/a/49633015/11207414">community post</a></p>
