fluent-plugin-azure-logs-ingestion 0.1.1 → 0.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a1c9a4f3c9cbe762fc5a559e35a38fc3b3e056f8ecf6f830c882fcd11b73bc19
-  data.tar.gz: f47c00750ec0a3b7995b6b9ac757d325f36865cbb1e5f18c6809541ac3011e2f
+  metadata.gz: 2d502da5879c0445acbdf411a24c2af70b7ad9016eb922474eda10f342d919c4
+  data.tar.gz: 2fee3972f2418f56c1cf5823bec48dc0abebe4e8738e108a7f727dca5e4d5b01
 SHA512:
-  metadata.gz: 709e94c88e7ac5b734cce439943a9f00cf42ff68f4a2d4dd4b91b7ff07aec9e472c6e27ae10fddc9964e213b6269de1a98f18d55ca6ea220b35a6568eac8041d
-  data.tar.gz: 113f9f8abb4ef51952697ff64ecd6fdc9693216a32620daab2df11bd2b6d837e9c87d5ba4edc37d38151a32f363303a4e060e25d3d0868664c4846474ebe9534
+  metadata.gz: 1e64e5b98b5dde247d1a73b9bb437114d87ca39caf79f5bc1dff20264e7980b12d09cfd0e9b8ee748516f9e4e1cccb8c35a5103f281e7fad93454754e348861a
+  data.tar.gz: a48c818655f21c3292fbd5e36327df8870e001935f878fcdd76cae804fb5a2341bac47cbe6647f3f2e6830c41e0cb80630b77d0ba78f0e8bfeb51a3a340a21dd

data/README.md

@@ -8,7 +8,7 @@ Fluentd output plugin that sends records to Log Analytics Workspace tables by us
 ## Supported Environment
 
 - Ruby 2.4 or later
-- Fluentd 1.x
+- Fluentd 1.13.0 or later, before 2.0
 
 ## Installation
 
@@ -35,7 +35,7 @@ Then run `bundle install`.
 Bundler can point directly at the GitHub repository. Specify `ref` when you want to pin a specific revision.
 
 ```ruby
-gem 'fluent-plugin-azure-logs-ingestion', git: 'https://github.com/fukasawah/fluent-plugin-azure-logs-ingestion.git', ref: 'abda3b5370ccd61282c8b234ca05042049e09d15'
+gem 'fluent-plugin-azure-logs-ingestion', git: 'https://github.com/fukasawah/fluent-plugin-azure-logs-ingestion.git', ref: 'dbb0160a8048957dafb3002799dc3e8567da06e6'
 ```
 
 Then run `bundle install`.
@@ -213,21 +213,14 @@ bundle install
 bundle exec rake test
 ```
 
-This project uses a single `Gemfile`. Set `FLUENTD_VERSION` when you want to test a specific Fluentd version.
-
-```bash
-bundle install
-bundle exec rake test
-```
-
-Use rbenv when you want to check compatibility with older Ruby / Fluentd versions locally. Environment variables are set only inside subshells, so they do not remain in your working shell. Run `rbenv exec` inside the block where `RBENV_VERSION` is set.
+This project uses a single `Gemfile`. Use rbenv and `FLUENTD_VERSION` when checking older Ruby / Fluentd combinations locally.
 
 ```bash
 rbenv init
 source ~/.bashrc
 
 (
-	export RBENV_VERSION=2.4.10 FLUENTD_VERSION=1.15.3
+	export RBENV_VERSION=2.4.10 FLUENTD_VERSION=1.13.0
 	unset GEM_HOME GEM_PATH MY_RUBY_HOME
 	rbenv install "$RBENV_VERSION" -s
 	rbenv exec gem install bundler -v 2.3.27 --no-document
@@ -235,7 +228,6 @@ source ~/.bashrc
 	rbenv exec bundle _2.3.27_ exec rake test
 )
 
-
 (
 	export RBENV_VERSION=2.7.8 FLUENTD_VERSION=1.18.0
 	unset GEM_HOME GEM_PATH MY_RUBY_HOME
@@ -246,17 +238,11 @@ source ~/.bashrc
 )
 ```
 
-CI also checks Ruby 2.4 / Fluentd 1.15 compatibility.
-
-RubyGems releases do not need separate gems for each Ruby / Fluentd combination. The gemspec `required_ruby_version` and `fluentd` dependency declare the supported range, so build and push one gem as usual.
-Compatibility checks run tests against the selected Ruby / Fluentd combinations. Build the distributable gem once with the current Ruby.
+Publish one RubyGems artifact. Compatibility is checked with tests; build the distributable gem once with the current Ruby.
 
 ```bash
-(
-	export BUNDLE_PATH=vendor/bundle
-	bundle install
-	bundle exec rake test
-	bundle exec gem build fluent-plugin-azure-logs-ingestion.gemspec --strict
-	gem push fluent-plugin-azure-logs-ingestion-*.gem
-)
+bundle install
+bundle exec rake test
+bundle exec gem build fluent-plugin-azure-logs-ingestion.gemspec --strict
+gem push fluent-plugin-azure-logs-ingestion-*.gem
 ```

data/README_ja.md

@@ -8,7 +8,7 @@ Azure Monitor Logs Ingestion API を使い、Log Analytics Workspace のテー
 ## サポート環境
 
 - Ruby 2.4 以上
-- Fluentd 1.x
+- Fluentd 1.13.0 以上、2.0 未満
 
 ## インストール
 
@@ -35,7 +35,7 @@ gem 'fluent-plugin-azure-logs-ingestion'
 Bundler で GitHub repository を直接指定でき、特定の revision に固定したい場合は、`ref` を指定します。
 
 ```ruby
-gem 'fluent-plugin-azure-logs-ingestion', git: 'https://github.com/fukasawah/fluent-plugin-azure-logs-ingestion.git', ref: 'abda3b5370ccd61282c8b234ca05042049e09d15'
+gem 'fluent-plugin-azure-logs-ingestion', git: 'https://github.com/fukasawah/fluent-plugin-azure-logs-ingestion.git', ref: 'dbb0160a8048957dafb3002799dc3e8567da06e6'
 ```
 
 その後、`bundle install` を実行してください。
@@ -213,21 +213,14 @@ bundle install
 bundle exec rake test
 ```
 
-この project は 1 つの `Gemfile` を使います。特定の Fluentd version を確認する場合は `FLUENTD_VERSION` を指定してください。
-
-```bash
-bundle install
-bundle exec rake test
-```
-
-古い Ruby / Fluentd version の互換性を手元で確認する場合は、rbenv を使います。環境変数は subshell の中だけで設定するため、作業中の shell には残りません。`rbenv exec` は `RBENV_VERSION` を設定した block の中で実行してください。
+この project は 1 つの `Gemfile` を使います。古い Ruby / Fluentd version の互換性を手元で確認する場合は、rbenv と `FLUENTD_VERSION` を使います。
 
 ```bash
 rbenv init
 source ~/.bashrc
 
 (
-	export RBENV_VERSION=2.4.10 FLUENTD_VERSION=1.15.3
+	export RBENV_VERSION=2.4.10 FLUENTD_VERSION=1.13.0
 	unset GEM_HOME GEM_PATH MY_RUBY_HOME
 	rbenv install "$RBENV_VERSION" -s
 	rbenv exec gem install bundler -v 2.3.27 --no-document
@@ -245,17 +238,11 @@ source ~/.bashrc
 )
 ```
 
-Ruby 2.4 / Fluentd 1.15 の互換性は CI でも確認します。
-
-RubyGems へ公開する gem は Ruby / Fluentd の組み合わせごとには分けません。gemspec の `required_ruby_version` と `fluentd` dependency が対応範囲を表すため、通常どおり 1 つの gem を build して push します。
-互換性確認では Ruby / Fluentd の組み合わせごとに test を実行します。配布する gem の build は現在の Ruby で 1 回だけ行います。
+RubyGems へ公開する gem は 1 つだけです。互換性は test で確認し、配布する gem は現在の Ruby で build します。
 
 ```bash
-(
-	export BUNDLE_PATH=vendor/bundle
-	bundle install
-	bundle exec rake test
-	bundle exec gem build fluent-plugin-azure-logs-ingestion.gemspec --strict
-	gem push fluent-plugin-azure-logs-ingestion-*.gem
-)
+bundle install
+bundle exec rake test
+bundle exec gem build fluent-plugin-azure-logs-ingestion.gemspec --strict
+gem push fluent-plugin-azure-logs-ingestion-*.gem
 ```

data/lib/fluent/plugin/azure_logs_ingestion/version.rb

@@ -3,7 +3,7 @@
 module Fluent
   module Plugin
     module AzureLogsIngestion
-      VERSION = '0.1.1'
+      VERSION = '0.1.2'
     end
   end
 end

data/test/helper.rb

@@ -1,5 +1,14 @@
 # frozen_string_literal: true
 
+if ENV['COVERAGE']
+	require 'simplecov'
+	SimpleCov.enable_coverage :branch if SimpleCov.respond_to?(:enable_coverage)
+	SimpleCov.start do
+		add_filter '/test/'
+		add_filter '/vendor/'
+		track_files 'lib/**/*.rb'
+	end
+end
 require 'test/unit'
 require 'fluent/test'
 

data/test/test_auth_msi.rb

@@ -43,6 +43,73 @@ class AuthManagedIdentityTest < Test::Unit::TestCase
     end
   end
 
+  test 'uses app service managed identity secret when header is absent' do
+    server = FakeAzureServer.new do |_request|
+      [200, { 'Content-Type' => 'application/json' }, { access_token: 'msi-token', expires_on: (Time.now.to_i + 3600).to_s }.to_json]
+    end.start
+
+    begin
+      with_env(
+        'IDENTITY_ENDPOINT' => "#{server.url}/msi/token?existing=1",
+        'IDENTITY_HEADER' => nil,
+        'MSI_SECRET' => 'msi-secret-value',
+        'AZURE_LOGS_INGESTION_IMDS_ENDPOINT' => nil
+      ) do
+        auth = Fluent::Plugin::AzureLogsIngestion::Auth.new(
+          use_msi: true,
+          tenant_id: nil,
+          client_id: '',
+          client_secret: nil,
+          authority_host: 'https://login.microsoftonline.com',
+          logs_ingestion_scope: 'https://monitor.azure.com/.default',
+          token_refresh_skew: 300,
+          logger: TestLogger.new
+        )
+
+        assert_equal 'msi-token', auth.token
+      end
+
+      request = server.requests.first
+      query = URI.decode_www_form(URI(request.path).query).to_h
+      assert_equal '1', query['existing']
+      assert_equal 'msi-secret-value', request.headers['secret']
+      assert_nil query['client_id']
+    ensure
+      server&.stop
+    end
+  end
+
+  test 'rejects invalid app service managed identity json response' do
+    server = FakeAzureServer.new do |_request|
+      [200, { 'Content-Type' => 'application/json' }, '{']
+    end.start
+
+    begin
+      with_env(
+        'IDENTITY_ENDPOINT' => "#{server.url}/msi/token",
+        'IDENTITY_HEADER' => 'identity-header-value',
+        'MSI_SECRET' => nil,
+        'AZURE_LOGS_INGESTION_IMDS_ENDPOINT' => nil
+      ) do
+        auth = Fluent::Plugin::AzureLogsIngestion::Auth.new(
+          use_msi: true,
+          tenant_id: nil,
+          client_id: nil,
+          client_secret: nil,
+          authority_host: 'https://login.microsoftonline.com',
+          logs_ingestion_scope: 'https://monitor.azure.com/.default',
+          token_refresh_skew: 300,
+          logger: TestLogger.new
+        )
+
+        error = assert_raise(RuntimeError) { auth.token }
+        assert_match(/failed to parse App Service managed identity response/, error.message)
+      end
+    ensure
+      server&.stop
+    end
+  end
+
   test 'uses IMDS endpoint when app service environment is absent' do
     server = FakeAzureServer.new do |_request|
       [200, { 'Content-Type' => 'application/json' }, { access_token: 'imds-token', expires_on: (Time.now.to_i + 3600).to_s }.to_json]
@@ -77,4 +144,64 @@ class AuthManagedIdentityTest < Test::Unit::TestCase
       server&.stop
     end
   end
+
+  test 'keeps retryable managed identity status retryable' do
+    server = FakeAzureServer.new do |_request|
+      [404, { 'Content-Type' => 'application/json' }, '{"error":"not ready"}']
+    end.start
+
+    begin
+      with_env(
+        'IDENTITY_ENDPOINT' => nil,
+        'IDENTITY_HEADER' => nil,
+        'AZURE_LOGS_INGESTION_IMDS_ENDPOINT' => "#{server.url}/metadata/identity/oauth2/token"
+      ) do
+        auth = Fluent::Plugin::AzureLogsIngestion::Auth.new(
+          use_msi: true,
+          tenant_id: nil,
+          client_id: nil,
+          client_secret: nil,
+          authority_host: 'https://login.microsoftonline.com',
+          logs_ingestion_scope: 'https://monitor.azure.com/.default',
+          token_refresh_skew: 300,
+          logger: TestLogger.new
+        )
+
+        error = assert_raise(RuntimeError) { auth.token }
+        assert_match(/404/, error.message)
+      end
+    ensure
+      server&.stop
+    end
+  end
+
+  test 'raises unrecoverable error for managed identity client error' do
+    server = FakeAzureServer.new do |_request|
+      [401, { 'Content-Type' => 'application/json' }, '{"error":"unauthorized"}']
+    end.start
+
+    begin
+      with_env(
+        'IDENTITY_ENDPOINT' => nil,
+        'IDENTITY_HEADER' => nil,
+        'AZURE_LOGS_INGESTION_IMDS_ENDPOINT' => "#{server.url}/metadata/identity/oauth2/token"
+      ) do
+        auth = Fluent::Plugin::AzureLogsIngestion::Auth.new(
+          use_msi: true,
+          tenant_id: nil,
+          client_id: nil,
+          client_secret: nil,
+          authority_host: 'https://login.microsoftonline.com',
+          logs_ingestion_scope: 'https://monitor.azure.com/.default',
+          token_refresh_skew: 300,
+          logger: TestLogger.new
+        )
+
+        error = assert_raise(Fluent::UnrecoverableError) { auth.token }
+        assert_match(/401/, error.message)
+      end
+    ensure
+      server&.stop
+    end
+  end
 end

data/test/test_auth_service_principal.rb

@@ -58,4 +58,144 @@ class AuthServicePrincipalTest < Test::Unit::TestCase
       server&.stop
     end
   end
+
+  test 'raises unrecoverable error for service principal client error' do
+    server = FakeAzureServer.new do |_request|
+      [401, { 'Content-Type' => 'application/json' }, '{"error":"unauthorized"}']
+    end.start
+
+    begin
+      auth = Fluent::Plugin::AzureLogsIngestion::Auth.new(
+        use_msi: false,
+        tenant_id: 'tenant-id',
+        client_id: 'client-id',
+        client_secret: 'secret',
+        authority_host: server.url,
+        logs_ingestion_scope: 'https://monitor.azure.com/.default',
+        token_refresh_skew: 300,
+        logger: TestLogger.new
+      )
+
+      error = assert_raise(Fluent::UnrecoverableError) { auth.token }
+      assert_match(/401/, error.message)
+    ensure
+      server&.stop
+    end
+  end
+
+  test 'raises retryable error for service principal server error' do
+    server = FakeAzureServer.new do |_request|
+      [500, { 'Content-Type' => 'application/json' }, '{"error":"server"}']
+    end.start
+
+    begin
+      auth = Fluent::Plugin::AzureLogsIngestion::Auth.new(
+        use_msi: false,
+        tenant_id: 'tenant-id',
+        client_id: 'client-id',
+        client_secret: 'secret',
+        authority_host: server.url,
+        logs_ingestion_scope: 'https://monitor.azure.com/.default',
+        token_refresh_skew: 300,
+        logger: TestLogger.new
+      )
+
+      error = assert_raise(RuntimeError) { auth.token }
+      assert_match(/500/, error.message)
+    ensure
+      server&.stop
+    end
+  end
+
+  test 'rejects token response without expiration' do
+    server = FakeAzureServer.new do |_request|
+      [200, { 'Content-Type' => 'application/json' }, { access_token: 'token-1' }.to_json]
+    end.start
+
+    begin
+      auth = Fluent::Plugin::AzureLogsIngestion::Auth.new(
+        use_msi: false,
+        tenant_id: 'tenant-id',
+        client_id: 'client-id',
+        client_secret: 'secret',
+        authority_host: server.url,
+        logs_ingestion_scope: 'https://monitor.azure.com/.default',
+        token_refresh_skew: 300,
+        logger: TestLogger.new
+      )
+
+      error = assert_raise(Fluent::UnrecoverableError) { auth.token }
+      assert_match(/expires_on or expires_in/, error.message)
+    ensure
+      server&.stop
+    end
+  end
+
+  test 'rejects token response with invalid expiration' do
+    server = FakeAzureServer.new do |_request|
+      [200, { 'Content-Type' => 'application/json' }, { access_token: 'token-1', expires_on: 'not-a-time' }.to_json]
+    end.start
+
+    begin
+      auth = Fluent::Plugin::AzureLogsIngestion::Auth.new(
+        use_msi: false,
+        tenant_id: 'tenant-id',
+        client_id: 'client-id',
+        client_secret: 'secret',
+        authority_host: "#{server.url}/",
+        logs_ingestion_scope: 'https://monitor.azure.com/.default',
+        token_refresh_skew: 300,
+        logger: TestLogger.new
+      )
+
+      error = assert_raise(Fluent::UnrecoverableError) { auth.token }
+      assert_match(/invalid expiration value/, error.message)
+    ensure
+      server&.stop
+    end
+  end
+
+  test 'wraps service principal connection failures' do
+    socket = TCPServer.new('127.0.0.1', 0)
+    authority_host = "http://127.0.0.1:#{socket.addr[1]}"
+    socket.close
+
+    auth = Fluent::Plugin::AzureLogsIngestion::Auth.new(
+      use_msi: false,
+      tenant_id: 'tenant-id',
+      client_id: 'client-id',
+      client_secret: 'secret',
+      authority_host: authority_host,
+      logs_ingestion_scope: 'https://monitor.azure.com/.default',
+      token_refresh_skew: 300,
+      logger: TestLogger.new
+    )
+
+    error = assert_raise(RuntimeError) { auth.token }
+    assert_match(/token request failed/, error.message)
+  end
+
+  test 'rejects invalid service principal json response' do
+    server = FakeAzureServer.new do |_request|
+      [200, { 'Content-Type' => 'application/json' }, '{']
+    end.start
+
+    begin
+      auth = Fluent::Plugin::AzureLogsIngestion::Auth.new(
+        use_msi: false,
+        tenant_id: 'tenant-id',
+        client_id: 'client-id',
+        client_secret: 'secret',
+        authority_host: server.url,
+        logs_ingestion_scope: 'https://monitor.azure.com/.default',
+        token_refresh_skew: 300,
+        logger: TestLogger.new
+      )
+
+      error = assert_raise(RuntimeError) { auth.token }
+      assert_match(/failed to parse service principal token response/, error.message)
+    ensure
+      server&.stop
+    end
+  end
 end

data/test/test_client.rb

@@ -0,0 +1,200 @@
+# frozen_string_literal: true
+
+require_relative 'helper'
+require_relative 'support/fake_azure_server'
+require_relative 'support/helpers'
+require 'fluent/plugin/azure_logs_ingestion/client'
+require 'tempfile'
+
+class ClientTest < Test::Unit::TestCase
+  Payload = Struct.new(:io, :content_encoding, :content_length)
+
+  def build_payload(body = '[{"message":"hello"}]', content_encoding = nil)
+    file = Tempfile.new('azure-logs-ingestion-client-test')
+    file.binmode
+    file.write(body)
+    file.flush
+    file.rewind
+    Payload.new(file, content_encoding, body.bytesize)
+  end
+
+  def build_client(server)
+    Fluent::Plugin::AzureLogsIngestion::Client.new(
+      endpoint: server.url,
+      dcr_immutable_id: 'dcr-immutable-id',
+      stream_name: 'Custom-MyTable',
+      logger: TestLogger.new
+    )
+  end
+
+  def build_client_for_endpoint(endpoint)
+    Fluent::Plugin::AzureLogsIngestion::Client.new(
+      endpoint: endpoint,
+      dcr_immutable_id: 'dcr-immutable-id',
+      stream_name: 'Custom-MyTable',
+      logger: TestLogger.new
+    )
+  end
+
+  def with_payload(body = '[{"message":"hello"}]', content_encoding = nil)
+    payload = build_payload(body, content_encoding)
+    yield payload
+  ensure
+    payload.io.close! if payload && payload.io
+  end
+
+  test 'sends payload to logs ingestion endpoint' do
+    server = FakeAzureServer.new do |_request|
+      [200, { 'Content-Type' => 'application/json' }, '{}']
+    end.start
+
+    begin
+      with_payload do |payload|
+        assert_equal true, build_client(server).send_payload(payload: payload, bearer_token: 'token-1')
+      end
+
+      request = server.requests.first
+      assert_equal 'POST', request.method
+      assert_match %r{/dataCollectionRules/dcr-immutable-id/streams/Custom-MyTable\?api-version=2023-01-01}, request.path
+      assert_equal 'Bearer token-1', request.headers['authorization']
+      assert_equal 'application/json', request.headers['content-type']
+      assert_not_nil request.headers['x-ms-client-request-id']
+      assert_match(/"message":"hello"/, request.body)
+    ensure
+      server&.stop
+    end
+  end
+
+  test 'sends content encoding when payload is compressed' do
+    server = FakeAzureServer.new { |_request| [200, {}, ''] }.start
+
+    begin
+      with_payload('compressed', 'gzip') do |payload|
+        build_client(server).send_payload(payload: payload, bearer_token: 'token-1')
+      end
+
+      assert_equal 'gzip', server.requests.first.headers['content-encoding']
+    ensure
+      server&.stop
+    end
+  end
+
+  test 'preserves endpoint path when endpoint has trailing slash' do
+    server = FakeAzureServer.new { |_request| [200, {}, ''] }.start
+
+    begin
+      with_payload do |payload|
+        build_client_for_endpoint("#{server.url}/").send_payload(payload: payload, bearer_token: 'token-1')
+      end
+
+      assert_match %r{\A/dataCollectionRules/dcr-immutable-id/streams/Custom-MyTable\?api-version=2023-01-01\z}, server.requests.first.path
+    ensure
+      server&.stop
+    end
+  end
+
+  test 'rejects invalid json body on successful response' do
+    server = FakeAzureServer.new { |_request| [200, { 'Content-Type' => 'application/json' }, '{'] }.start
+
+    begin
+      with_payload do |payload|
+        error = assert_raise(RuntimeError) do
+          build_client(server).send_payload(payload: payload, bearer_token: 'token-1')
+        end
+        assert_match(/successful response body was not valid JSON/, error.message)
+      end
+    ensure
+      server&.stop
+    end
+  end
+
+  test 'treats documented client errors as unrecoverable' do
+    [400, 401, 403, 413].each do |status|
+      server = FakeAzureServer.new { |_request| [status, {}, 'client error'] }.start
+
+      begin
+        with_payload do |payload|
+          error = assert_raise(Fluent::UnrecoverableError) do
+            build_client(server).send_payload(payload: payload, bearer_token: 'token-1')
+          end
+          assert_match(/#{status}/, error.message)
+        end
+      ensure
+        server&.stop
+      end
+    end
+  end
+
+  test 'keeps 5xx retryable' do
+    server = FakeAzureServer.new { |_request| [500, {}, 'server error'] }.start
+
+    begin
+      with_payload do |payload|
+        error = assert_raise(RuntimeError) do
+          build_client(server).send_payload(payload: payload, bearer_token: 'token-1')
+        end
+        assert_match(/500/, error.message)
+      end
+    ensure
+      server&.stop
+    end
+  end
+
+  test 'keeps 429 retryable without retry after header' do
+    server = FakeAzureServer.new { |_request| [429, {}, 'throttled'] }.start
+
+    begin
+      with_payload do |payload|
+        error = assert_raise(RuntimeError) do
+          build_client(server).send_payload(payload: payload, bearer_token: 'token-1')
+        end
+        assert_match(/429/, error.message)
+      end
+    ensure
+      server&.stop
+    end
+  end
+
+  test 'treats other client errors as unrecoverable' do
+    server = FakeAzureServer.new { |_request| [418, {}, 'teapot'] }.start
+
+    begin
+      with_payload do |payload|
+        error = assert_raise(Fluent::UnrecoverableError) do
+          build_client(server).send_payload(payload: payload, bearer_token: 'token-1')
+        end
+        assert_match(/418/, error.message)
+      end
+    ensure
+      server&.stop
+    end
+  end
+
+  test 'treats redirects as retryable unexpected responses' do
+    server = FakeAzureServer.new { |_request| [302, { 'Location' => 'https://example.invalid/' }, 'redirect'] }.start
+
+    begin
+      with_payload do |payload|
+        error = assert_raise(RuntimeError) do
+          build_client(server).send_payload(payload: payload, bearer_token: 'token-1')
+        end
+        assert_match(/302/, error.message)
+      end
+    ensure
+      server&.stop
+    end
+  end
+
+  test 'wraps connection failures as retryable runtime errors' do
+    socket = TCPServer.new('127.0.0.1', 0)
+    endpoint = "http://127.0.0.1:#{socket.addr[1]}"
+    socket.close
+
+    with_payload do |payload|
+      error = assert_raise(RuntimeError) do
+        build_client_for_endpoint(endpoint).send_payload(payload: payload, bearer_token: 'token-1')
+      end
+      assert_match(/logs ingestion request failed/, error.message)
+    end
+  end
+end

data/test/test_out_azure_logs_ingestion.rb

@@ -57,4 +57,41 @@ class AzureLogsIngestionOutputTest < Test::Unit::TestCase
 
     assert_match(/tenant_id, client_id, and client_secret/, error.message)
   end
+
+  test 'rejects invalid endpoint url' do
+    error = assert_raise(Fluent::ConfigError) do
+      create_driver(<<~CONFIG)
+        endpoint not-a-url
+        dcr_immutable_id dcr-000a00a000a00000a000000aa000a0aa
+        stream_name Custom-MyTable
+        tenant_id test-tenant
+        client_id test-client
+        client_secret test-secret
+        <buffer>
+          @type memory
+        </buffer>
+      CONFIG
+    end
+
+    assert_match(/endpoint must be a valid HTTP or HTTPS URL/, error.message)
+  end
+
+  test 'rejects invalid authority host url' do
+    error = assert_raise(Fluent::ConfigError) do
+      create_driver(<<~CONFIG)
+        endpoint https://example.eastus-1.ingest.monitor.azure.com
+        authority_host not-a-url
+        dcr_immutable_id dcr-000a00a000a00000a000000aa000a0aa
+        stream_name Custom-MyTable
+        tenant_id test-tenant
+        client_id test-client
+        client_secret test-secret
+        <buffer>
+          @type memory
+        </buffer>
+      CONFIG
+    end
+
+    assert_match(/authority_host must be a valid HTTP or HTTPS URL/, error.message)
+  end
 end

data/test/test_out_azure_logs_ingestion_write.rb

@@ -175,4 +175,43 @@ class AzureLogsIngestionWriteTest < Test::Unit::TestCase
       server&.stop
     end
   end
+
+  test 'closes payload when sending fails' do
+    server = FakeAzureServer.new do |request|
+      case request.path
+      when %r{/tenant/oauth2/v2.0/token}
+        [200, { 'Content-Type' => 'application/json' }, { access_token: 'token-1', expires_in: '3600' }.to_json]
+      else
+        [500, {}, 'server error']
+      end
+    end.start
+
+    driver = create_driver(<<~CONFIG)
+      endpoint #{server.url}
+      authority_host #{server.url}
+      dcr_immutable_id dcr-000a00a000a00000a000000aa000a0aa
+      stream_name Custom-MyTable
+      tenant_id tenant
+      client_id client
+      client_secret secret
+      <buffer>
+        @type memory
+      </buffer>
+    CONFIG
+
+    begin
+      driver.instance.start
+      error = assert_raise(RuntimeError) do
+        driver.instance.write(FakeChunk.new([
+          [Fluent::EventTime.from_time(Time.utc(2026, 1, 1, 0, 0, 0)), { 'message' => 'hello' }]
+        ]))
+      end
+
+      assert_match(/500/, error.message)
+    ensure
+      driver&.instance&.shutdown
+      driver&.instance&.close
+      server&.stop
+    end
+  end
 end

data/test/test_payload_builder.rb

@@ -42,13 +42,18 @@ class PayloadBuilderTest < Test::Unit::TestCase
   test 'accepts wide time span' do
     builder = Fluent::Plugin::AzureLogsIngestion::PayloadBuilder.new(gzip: false)
 
-    result = builder.build(FakeChunk.new([
-      [Fluent::EventTime.from_time(Time.utc(2026, 1, 1, 0, 0, 0)), {}],
-      [Fluent::EventTime.from_time(Time.utc(2026, 1, 1, 0, 31, 0)), {}]
-    ]))
+    begin
+      result = builder.build(FakeChunk.new([
+        [Fluent::EventTime.from_time(Time.utc(2026, 1, 1, 0, 0, 0)), { 'message' => 'first' }],
+        [Fluent::EventTime.from_time(Time.utc(2026, 1, 1, 0, 31, 0)), { 'message' => 'second' }]
+      ]))
 
-    assert_equal 2, result.record_count
-    result&.close!
+      records = JSON.parse(result.io.read)
+      assert_equal 2, result.record_count
+      assert_equal %w[first second], records.map { |record| record['message'] }
+    ensure
+      result&.close!
+    end
   end
 
   test 'builds gzip payload when enabled' do
@@ -121,4 +126,56 @@ class PayloadBuilderTest < Test::Unit::TestCase
 
     assert_match(/payload size|gzip payload size/, error.message)
   end
+
+  test 'rejects oversized gzip payload even when raw payload fits' do
+    builder_class = Class.new(Fluent::Plugin::AzureLogsIngestion::PayloadBuilder) do
+      private
+
+      def gzip_file_from(source_file)
+        gzip_file = Tempfile.new('azure-logs-ingestion-test-gzip')
+        gzip_file.binmode
+        source_file.rewind
+        IO.copy_stream(source_file, gzip_file)
+        gzip_file.flush
+        gzip_file.rewind
+        [gzip_file, Fluent::Plugin::AzureLogsIngestion::PayloadBuilder::MAX_BYTES + 1]
+      end
+    end
+    builder = builder_class.new(gzip: true)
+
+    error = assert_raise(Fluent::UnrecoverableError) do
+      builder.build(FakeChunk.new([
+        [Fluent::EventTime.from_time(Time.utc(2026, 1, 1, 0, 0, 0)), { 'message' => 'hello' }]
+      ]))
+    end
+
+    assert_match(/gzip payload size/, error.message)
+  end
+
+  test 'closes gzip tempfile when validation fails after gzip is built' do
+    captured_file = nil
+    builder_class = Class.new(Fluent::Plugin::AzureLogsIngestion::PayloadBuilder) do
+      define_method(:captured_file) { captured_file }
+
+      private
+
+      define_method(:gzip_file_from) do |source_file|
+        gzip_file, gzip_size = super(source_file)
+        captured_file = gzip_file
+        [gzip_file, gzip_size]
+      end
+
+      def validate!(raw_size:, gzip_size:)
+        raise 'forced validation failure'
+      end
+    end
+    builder = builder_class.new(gzip: true)
+
+    assert_raise(RuntimeError) do
+      builder.build(FakeChunk.new([
+        [Fluent::EventTime.from_time(Time.utc(2026, 1, 1, 0, 0, 0)), { 'message' => 'hello' }]
+      ]))
+    end
+    assert_equal true, captured_file.closed?
+  end
 end

data/test/test_version.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+require_relative 'helper'
+require 'fluent/plugin/azure_logs_ingestion/version'
+
+class VersionTest < Test::Unit::TestCase
+  test 'defines plugin version' do
+    assert_match(/\A\d+\.\d+\.\d+\z/, Fluent::Plugin::AzureLogsIngestion::VERSION)
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: fluent-plugin-azure-logs-ingestion
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.1.2
 platform: ruby
 authors:
 - fukasawah
@@ -15,7 +15,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '1.15'
+        version: 1.13.0
     - - "<"
       - !ruby/object:Gem::Version
         version: '2'
@@ -25,7 +25,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '1.15'
+        version: 1.13.0
     - - "<"
       - !ruby/object:Gem::Version
         version: '2'
@@ -79,9 +79,11 @@ files:
 - test/support/helpers.rb
 - test/test_auth_msi.rb
 - test/test_auth_service_principal.rb
+- test/test_client.rb
 - test/test_out_azure_logs_ingestion.rb
 - test/test_out_azure_logs_ingestion_write.rb
 - test/test_payload_builder.rb
+- test/test_version.rb
 homepage: https://github.com/fukasawah/fluent-plugin-azure-logs-ingestion
 licenses:
 - Apache-2.0