logstash-logger 1.0.0 → 1.1.0

data/spec/device/http_spec.rb

@@ -4,8 +4,173 @@ describe LogStashLogger::Device::HTTP do
   include_context 'device'
 
   it "Post event to HTTP" do
-    expect(Net::HTTP).to receive(:post)
+    expect(Net::HTTP).to receive(:post).and_return(Net::HTTPOK.new('1.1', '200', 'OK'))
     http_device.write('test')
   end
 
+  describe "body format" do
+    let(:url) { 'http://localhost' }
+    let(:messages) { ["{\"a\":1}\n", "{\"b\":2}"] }
+
+    it "sends a JSON array by default" do
+      device = LogStashLogger::Device.new(type: :http, url: url, sync: true)
+      expect(Net::HTTP).to receive(:post)
+        .with(URI(url), "[{\"a\":1}\n,{\"b\":2}]", anything)
+        .and_return(Net::HTTPOK.new('1.1', '200', 'OK'))
+      device.write_batch(messages)
+    end
+
+    it "sends a JSON array with format: :json_array" do
+      device = LogStashLogger::Device.new(type: :http, url: url, sync: true, format: :json_array)
+      expect(Net::HTTP).to receive(:post)
+        .with(URI(url), "[{\"a\":1}\n,{\"b\":2}]", anything)
+        .and_return(Net::HTTPOK.new('1.1', '200', 'OK'))
+      device.write_batch(messages)
+    end
+
+    it "sends newline-delimited JSON with format: :ndjson" do
+      device = LogStashLogger::Device.new(type: :http, url: url, sync: true, format: :ndjson)
+      expect(Net::HTTP).to receive(:post)
+        .with(URI(url), "{\"a\":1}\n{\"b\":2}\n", anything)
+        .and_return(Net::HTTPOK.new('1.1', '200', 'OK'))
+      device.write_batch(messages)
+    end
+
+    it "accepts the format as a string" do
+      device = LogStashLogger::Device.new(type: :http, url: url, sync: true, format: "ndjson")
+      expect(Net::HTTP).to receive(:post)
+        .with(URI(url), "{\"a\":1}\n{\"b\":2}\n", anything)
+        .and_return(Net::HTTPOK.new('1.1', '200', 'OK'))
+      device.write_batch(messages)
+    end
+
+    it "raises an error for an unknown format" do
+      expect {
+        LogStashLogger::Device.new(type: :http, url: url, sync: true, format: :xml)
+      }.to raise_error(ArgumentError, /Unknown HTTP body format: :xml/)
+    end
+  end
+
+  describe "content type" do
+    let(:url) { 'http://localhost' }
+
+    def expect_content_type(type)
+      expect(Net::HTTP).to receive(:post)
+        .with(anything, anything, {"Content-Type" => type})
+        .and_return(Net::HTTPOK.new('1.1', '200', 'OK'))
+    end
+
+    it "is application/json by default" do
+      device = LogStashLogger::Device.new(type: :http, url: url, sync: true)
+      expect_content_type("application/json")
+      device.write_batch(["{}"])
+    end
+
+    it "is application/x-ndjson for format: :ndjson" do
+      device = LogStashLogger::Device.new(type: :http, url: url, sync: true, format: :ndjson)
+      expect_content_type("application/x-ndjson")
+      device.write_batch(["{}"])
+    end
+
+    it "can be overridden with content_type" do
+      device = LogStashLogger::Device.new(type: :http, url: url, sync: true, format: :ndjson, content_type: "application/json")
+      expect_content_type("application/json")
+      device.write_batch(["{}"])
+    end
+  end
+
+  it "does not raise on a successful response" do
+    allow(Net::HTTP).to receive(:post).and_return(Net::HTTPOK.new('1.1', '200', 'OK'))
+    expect { http_device.write_batch(['test']) }.not_to raise_error
+  end
+
+  it "raises on an error response" do
+    allow(Net::HTTP).to receive(:post).and_return(Net::HTTPInternalServerError.new('1.1', '500', 'Internal Server Error'))
+    expect { http_device.write_batch(['test']) }.to raise_error(RuntimeError, "HTTP log upload failed: 500 Internal Server Error")
+  end
+
+  it "raises on a client error response" do
+    allow(Net::HTTP).to receive(:post).and_return(Net::HTTPUnauthorized.new('1.1', '401', 'Unauthorized'))
+    expect { http_device.write_batch(['test']) }.to raise_error(RuntimeError, /401 Unauthorized/)
+  end
+end
+
+describe LogStashLogger::Device::HTTP, 'records the collector rejects' do
+  let(:url) { 'http://localhost' }
+  let(:error_log) { StringIO.new }
+  let(:sent) { [] }
+  let(:small) { (1..5).map { |i| %({"n":#{i}}) } }
+
+  def device(**opts)
+    LogStashLogger::Device.new({ type: :http, url: url, sync: false, buffer_max_interval: 3600,
+                                 buffer_flush_at_exit: false, error_logger: ::Logger.new(error_log) }.merge(opts))
+  end
+
+  # Stubs the HTTP endpoint: any request containing a "BAD" record gets the
+  # given error status, and every other request succeeds and is recorded.
+  def stub_endpoint_rejecting_bad_records(status:, message:)
+    allow(Net::HTTP).to receive(:post) do |_url, body, _headers|
+      if body.include?('BAD')
+        klass = Net::HTTPResponse::CODE_TO_OBJ[status]
+        klass.new('1.1', status, message)
+      else
+        sent << body
+        Net::HTTPOK.new('1.1', '200', 'OK')
+      end
+    end
+  end
+
+  it 'delivers the other records and drops only the rejected one' do
+    stub_endpoint_rejecting_bad_records(status: '413', message: 'Payload Too Large')
+    device.write_batch(small + ['"BAD"'])
+    expect(sent).to eq(small.map { |m| "[#{m}]" })
+    expect(error_log.string).to include('dropping a record of 5 bytes that the collector rejected: HTTP 413')
+  end
+
+  it 'drops a rejected single-record batch without raising' do
+    stub_endpoint_rejecting_bad_records(status: '400', message: 'Bad Request')
+    expect { device.write_batch(['"BAD"']) }.not_to raise_error
+    expect(error_log.string).to include('HTTP 400')
+  end
+
+  it 'clears a buffered batch instead of retrying the rejected record forever' do
+    stub_endpoint_rejecting_bad_records(status: '422', message: 'Unprocessable Entity')
+    dev = device
+    small.each { |m| dev.write(m) }
+    dev.write('"BAD"')
+    dev.buffer_flush(force: true)
+    expect(dev.instance_variable_get(:@buffer_state)[:pending_count]).to eq(0)
+    expect(sent.size).to eq(small.size)
+  end
+
+  # Errors that do not depend on the records, so the batch is retried
+  {
+    '401' => 'Unauthorized',          # missing or wrong credentials
+    '403' => 'Forbidden',             # credentials not allowed
+    '404' => 'Not Found',             # wrong URL, or the collector is not deployed yet
+    '429' => 'Too Many Requests',     # rate limited
+    '500' => 'Internal Server Error', # collector error
+    '503' => 'Service Unavailable',   # collector down or restarting
+  }.each do |status, message|
+    it "retries the whole batch on HTTP #{status} #{message}" do
+      stub_endpoint_rejecting_bad_records(status: status, message: message)
+      expect { device.write_batch(['"BAD"', 'ok']) }.to raise_error(RuntimeError, /HTTP log upload failed: #{status}/)
+      expect(error_log.string).to include("HTTP log upload failed: #{status}")
+    end
+  end
+
+  it 'raises if a record sent on its own hits a retryable error' do
+    calls = 0
+    allow(Net::HTTP).to receive(:post) do
+      calls += 1
+      calls == 1 ? Net::HTTPRequestEntityTooLarge.new('1.1', '413', 'Too Large') : Net::HTTPServiceUnavailable.new('1.1', '503', 'Unavailable')
+    end
+    expect { device.write_batch(['a', 'b']) }.to raise_error(RuntimeError, /503/)
+  end
+
+  it 'sends records that are not Strings as text' do
+    allow(Net::HTTP).to receive(:post) { |_u, body, _h| sent << body; Net::HTTPOK.new('1.1', '200', 'OK') }
+    device(format: :ndjson).write_batch([123, '{"a":1}'])
+    expect(sent).to eq(["123\n{\"a\":1}\n"])
+  end
 end

data/spec/device/kafka_spec.rb

@@ -1,4 +1,7 @@
 require 'logstash-logger'
+# The device requires ruby-kafka only when the first one is built. Load it here
+# so the classes reopened below and Kafka::SslContext exist in any test order.
+require 'ruby-kafka'
 
 describe LogStashLogger::Device::Kafka::TLSConfiguration do
   context "with TLS" do
@@ -353,3 +356,92 @@ describe LogStashLogger::Device::Kafka do
     end
   end
 end
+
+describe LogStashLogger::Device::Kafka, 'records the broker always rejects' do
+  # Stands in for a ruby-kafka producer: rejects any delivery that contains a
+  # record over the limit, the way a broker answers MESSAGE_TOO_LARGE.
+  class FakeKafkaProducer
+    LIMIT = 1_000
+
+    def initialize(delivered, errors = {})
+      @delivered = delivered
+      @errors = errors
+      @buffer = []
+    end
+
+    def produce(message, topic:)
+      raise ::Kafka::BufferOverflow, 'buffer full' if message.bytesize > LIMIT * 10
+      @buffer << message
+    end
+
+    def deliver_messages
+      if (error = @errors.delete(:next_delivery))
+        @buffer.clear
+        raise error
+      end
+      if @buffer.any? { |m| m.bytesize > LIMIT }
+        @buffer.clear
+        raise ::Kafka::MessageSizeTooLarge, 'message too large'
+      end
+      @delivered.concat(@buffer)
+      @buffer.clear
+    end
+
+    def shutdown; end
+  end
+
+  let(:delivered) { [] }
+  let(:errors) { {} }
+  let(:error_log) { StringIO.new }
+  let(:device) do
+    LogStashLogger::Device::Kafka.new(topic: 'logs', brokers: 'localhost:9092', sync: false,
+      buffer_max_interval: 3600, buffer_flush_at_exit: false, error_logger: ::Logger.new(error_log))
+  end
+
+  before do
+    allow(device).to receive(:connection) do
+      double('connection', producer: FakeKafkaProducer.new(delivered, errors), close: true)
+    end
+  end
+
+  let(:small) { (1..5).map { |i| %({"n":#{i}}) } }
+
+  it 'delivers the other records and drops only an oversized one' do
+    device.write_batch(small + ['x' * 2_000])
+    expect(delivered).to eq(small)
+    expect(error_log.string).to include('dropping a record of 2000 bytes that Kafka rejected: Kafka::MessageSizeTooLarge')
+  end
+
+  it 'drops a record the client buffer cannot hold' do
+    device.write_batch(small + ['x' * 20_000])
+    expect(delivered).to eq(small)
+    expect(error_log.string).to include('Kafka::BufferOverflow')
+  end
+
+  it 'delivers everything when the batch is only too large as a whole' do
+    allow(device).to receive(:connection) do
+      producer = FakeKafkaProducer.new(delivered, errors)
+      def producer.deliver_messages
+        raise ::Kafka::MessageSizeTooLarge, 'batch too large' if @buffer.size > 1
+        super
+      end
+      double('connection', producer: producer, close: true)
+    end
+    device.write_batch(small)
+    expect(delivered).to eq(small)
+  end
+
+  it 'still raises transient errors so the buffer retries the batch' do
+    errors[:next_delivery] = ::Kafka::ConnectionError.new('broker unavailable')
+    expect { device.write_batch(small) }.to raise_error(::Kafka::ConnectionError)
+  end
+
+  it 'clears the buffer instead of holding other records behind the rejected one' do
+    small.each { |m| device.write(m) }
+    device.write('x' * 2_000)
+    device.buffer_flush(force: true)
+
+    expect(delivered).to eq(small)
+    expect(device.instance_variable_get(:@buffer_state)[:pending_count]).to eq(0)
+  end
+end

data/spec/device/kinesis_spec.rb

@@ -30,9 +30,12 @@ describe LogStashLogger::Device::Kinesis do
     response.records = [failed_record]
 
     expect(client).to receive(:put_records) { response }
-    expect(kinesis_device).to receive(:write).with("foo")
+    expect(kinesis_device).not_to receive(:write)
 
     kinesis_device.write_one "foo"
+    state = kinesis_device.instance_variable_get(:@buffer_state)
+    expect(state[:pending_items][nil]).to eq(["foo"])
+    expect(state[:pending_count]).to eq(1)
   end
 
   it "defaults the kinesis stream to logstash" do

data/spec/device/tcp_spec.rb

@@ -1,4 +1,5 @@
 require 'logstash-logger'
+require_relative '../support/tls_helper'
 
 describe LogStashLogger::Device::TCP do
   include_context 'device'
@@ -13,6 +14,9 @@ describe LogStashLogger::Device::TCP do
     allow(OpenSSL::SSL::SSLSocket).to receive(:new) { ssl_socket }
     allow(ssl_socket).to receive(:connect)
     allow(ssl_socket).to receive(:post_connection_check)
+    allow(ssl_socket).to receive(:sync_close=)
+    allow(ssl_socket).to receive(:hostname=)
+    allow(tcp_socket).to receive(:close)
     allow(ssl_tcp_device).to receive(:warn)
   end
 
@@ -103,16 +107,101 @@ describe LogStashLogger::Device::TCP do
     end
 
     context 'without a provided SSL context' do
-      it 'ssl_context returns nil' do
-        expect(ssl_tcp_device.ssl_context).to be_nil
+      it 'uses a context that verifies the server certificate' do
+        ctx = ssl_tcp_device.ssl_context
+        expect(ctx).to be_a(OpenSSL::SSL::SSLContext)
+        expect(ctx.verify_mode).to eq(OpenSSL::SSL::VERIFY_PEER)
+        expect(ctx.verify_hostname).to be true
+        expect(ctx.cert_store).not_to be_nil
+      end
+
+      it 'creates the socket with that context' do
+        expect(OpenSSL::SSL::SSLSocket).to receive(:new).with(tcp_socket, ssl_tcp_device.ssl_context)
+        ssl_tcp_device.connect
+      end
+
+      it 'verifies the hostname after connecting' do
+        expect(ssl_socket).to receive(:post_connection_check).with(HOST)
+        ssl_tcp_device.connect
+      end
+
+      context 'with verify_hostname: false' do
+        let(:ssl_tcp_device) { LogStashLogger::Device.new(type: :tcp, port: port, ssl_enable: true, sync: true, verify_hostname: false) }
+
+        it 'still verifies the certificate chain' do
+          expect(ssl_tcp_device.ssl_context.verify_mode).to eq(OpenSSL::SSL::VERIFY_PEER)
+        end
+
+        it 'does not verify the hostname' do
+          expect(ssl_tcp_device.ssl_context.verify_hostname).to be false
+          expect(ssl_socket).not_to receive(:post_connection_check)
+          ssl_tcp_device.connect
+        end
+      end
+    end
+
+    context 'server name indication' do
+      it 'is sent for a DNS hostname' do
+        device = LogStashLogger::Device.new(type: :tcp, host: 'logstash.example.com', port: port, ssl_enable: true, sync: true)
+        expect(ssl_socket).to receive(:hostname=).with('logstash.example.com')
+        device.connect
+      end
+
+      it 'is not sent for an IP address' do
+        expect(ssl_socket).not_to receive(:hostname=)
+        ssl_tcp_device.connect
+      end
+    end
+
+    it 'closes the TCP socket together with the SSL socket' do
+      expect(ssl_socket).to receive(:sync_close=).with(true)
+      ssl_tcp_device.connect
+    end
+
+    context 'when the SSL socket cannot be created' do
+      before do
+        allow(OpenSSL::SSL::SSLSocket).to receive(:new).and_raise(OpenSSL::SSL::SSLError, 'boom')
+      end
+
+      it 'closes the TCP socket it opened' do
+        expect(tcp_socket).to receive(:close).once
+        expect { ssl_tcp_device.connect }.to raise_error(OpenSSL::SSL::SSLError)
       end
     end
 
     context 'only providing a certificate file' do
-      let(:ssl_tcp_device) { LogStashLogger::Device.new(type: :tcp, port: port, ssl_enable: true, sync: true, ssl_certificate: '/path/to/cert.pem') }
+      let(:cert_file) { TLSHelper.cert_file(TLSHelper.self_signed.first) }
+      let(:ssl_tcp_device) { LogStashLogger::Device.new(type: :tcp, port: port, ssl_enable: true, sync: true, ssl_certificate: cert_file.path) }
+
+      after { cert_file.close! }
+
+      it 'trusts that certificate and verifies the server against it' do
+        ctx = ssl_tcp_device.ssl_context
+        expect(ctx.ca_file).to eq(cert_file.path)
+        expect(ctx.verify_mode).to eq(OpenSSL::SSL::VERIFY_PEER)
+        expect(ctx.verify_hostname).to be true
+      end
+
+      it 'enables SSL implicitly' do
+        device = LogStashLogger::Device.new(type: :tcp, port: port, sync: true, ssl_certificate: cert_file.path)
+        expect(device.use_ssl?).to be_truthy
+      end
+
+      it 'rejects a missing file' do
+        expect {
+          LogStashLogger::Device.new(type: :tcp, port: port, sync: true, ssl_certificate: '/nonexistent/cert.pem')
+        }.to raise_error(ArgumentError, /readable certificate file/)
+      end
 
-      it 'implicitly uses a context with the configured certificate' do
-        expect(ssl_tcp_device.ssl_context.cert).to eq('/path/to/cert.pem')
+      it 'rejects a file that is not a certificate' do
+        not_a_cert = Tempfile.new('not-a-cert')
+        not_a_cert.write('hello')
+        not_a_cert.flush
+        expect {
+          LogStashLogger::Device.new(type: :tcp, port: port, sync: true, ssl_certificate: not_a_cert.path)
+        }.to raise_error(ArgumentError, /not a PEM or DER certificate/)
+      ensure
+        not_a_cert.close!
       end
     end
   end

data/spec/device/tcp_tls_integration_spec.rb

@@ -0,0 +1,91 @@
+require 'logstash-logger'
+require 'logger'
+require 'socket'
+require_relative '../support/tls_helper'
+
+# Real TLS handshakes against a loopback server that presents a throwaway
+# self-signed certificate. Nothing leaves 127.0.0.1.
+describe LogStashLogger::Device::TCP, 'TLS verification against a real server' do
+  before(:all) do
+    @cert, @key = TLSHelper.self_signed(dns: ['localhost'], ips: [])
+    @cert_file = TLSHelper.cert_file(@cert)
+  end
+
+  after(:all) { @cert_file.close! }
+
+  let(:received) { Queue.new }
+  let(:server) do
+    tcp = TCPServer.new('127.0.0.1', 0)
+    ctx = OpenSSL::SSL::SSLContext.new
+    ctx.cert = @cert
+    ctx.key = @key
+    OpenSSL::SSL::SSLServer.new(tcp, ctx)
+  end
+  let(:port) { server.to_io.addr[1] }
+
+  before do
+    srv = server
+    q = received
+    @server_thread = Thread.new do
+      loop do
+        begin
+          client = srv.accept
+          q << client.gets
+          client.close
+        rescue OpenSSL::SSL::SSLError, IOError, SystemCallError
+          # A rejected handshake is expected in several examples
+          break if srv.to_io.closed?
+        end
+      end
+    end
+  end
+
+  after do
+    server.close rescue nil
+    @server_thread.kill
+    @server_thread.join(1)
+  end
+
+  def device(**opts)
+    LogStashLogger::Device.new(
+      { type: :tcp, port: port, sync: true, buffer_flush_at_exit: false,
+        error_logger: ::Logger.new(IO::NULL) }.merge(opts)
+    )
+  end
+
+  def deliver(dev)
+    dev.connect
+    dev.io.write(%({"message":"hello"}\n))
+    dev.io.flush
+    line = received.pop(timeout: 5)
+    dev.close!
+    line
+  end
+
+  it 'refuses a self-signed certificate when only ssl_enable is set' do
+    expect { device(host: 'localhost', ssl_enable: true).connect }
+      .to raise_error(OpenSSL::SSL::SSLError)
+  end
+
+  it 'delivers when the certificate is trusted through ssl_certificate' do
+    expect(deliver(device(host: 'localhost', ssl_certificate: @cert_file.path)))
+      .to eq(%({"message":"hello"}\n))
+  end
+
+  it 'refuses a certificate whose name does not match the host' do
+    expect { device(host: '127.0.0.1', ssl_certificate: @cert_file.path).connect }
+      .to raise_error(OpenSSL::SSL::SSLError)
+  end
+
+  it 'checks the name given in verify_hostname when connecting by IP' do
+    dev = device(host: '127.0.0.1', ssl_certificate: @cert_file.path, verify_hostname: 'localhost')
+    expect(deliver(dev)).to eq(%({"message":"hello"}\n))
+  end
+
+  it 'still allows an explicit VERIFY_NONE context as an opt-out' do
+    ctx = OpenSSL::SSL::SSLContext.new
+    ctx.verify_mode = OpenSSL::SSL::VERIFY_NONE
+    dev = device(host: '127.0.0.1', ssl_context: ctx, verify_hostname: false)
+    expect(deliver(dev)).to eq(%({"message":"hello"}\n))
+  end
+end

data/spec/formatter/base_spec.rb

@@ -24,19 +24,55 @@ describe LogStashLogger::Formatter::Base do
       end
     end
 
-    context "when exception is raised" do
+    context "when building the event raises" do
       before do
-        allow(subject).to receive(:error_logger).and_return(Logger.new('/dev/null'))
-        allow(subject).to receive(:format_event).and_throw
+        allow(subject).to receive(:error_logger).and_return(Logger.new(IO::NULL))
+        allow(subject).to receive(:build_event).and_raise(ArgumentError, 'boom')
       end
 
       it "logs an exception" do
-        expect(subject).to receive(:log_error)
+        expect(subject).to receive(:log_error).and_call_original
         subject.call(severity, time, progname, message)
       end
 
-      it "returns a failed to format message" do
-        expect(subject.call(severity, time, progname, message)).to eq(LogStashLogger::Formatter::Base::FAILED_TO_FORMAT_MSG)
+      it "returns a well-formed placeholder event instead of a bare string" do
+        event = subject.call(severity, time, progname, message)
+        expect(event).to be_a(LogStash::Event)
+        expect(event['message']).to eq(LogStashLogger::Formatter::Base::FAILED_TO_FORMAT_MSG)
+        expect(event['tags']).to eq([LogStashLogger::Formatter::Base::FAILED_TO_FORMAT_TAG])
+        expect(event['error']).to eq('ArgumentError')
+        expect(event['severity']).to eq(severity)
+        expect(event['@timestamp']).to eq(time.iso8601(3))
+      end
+    end
+
+    context "when even the placeholder cannot be formatted" do
+      before do
+        allow(subject).to receive(:error_logger).and_return(Logger.new(IO::NULL))
+        allow(subject).to receive(:format_event).and_raise(ArgumentError, 'boom')
+      end
+
+      it "returns nil, which devices drop" do
+        expect(subject.call(severity, time, progname, message)).to be_nil
+      end
+    end
+
+    context "when logged content carries an @timestamp that is not a time" do
+      let(:message) { '{"message":"hello","@timestamp":"not-a-time"}' }
+
+      it "keeps the logger time and formats the record normally" do
+        event = subject.call(severity, time, progname, message)
+        expect(event['message']).to eq('hello')
+        expect(event['@timestamp']).to eq(time.iso8601(3))
+      end
+    end
+
+    context "when logged content carries a valid @timestamp" do
+      let(:message) { '{"message":"hello","@timestamp":"2001-01-01T00:00:00Z"}' }
+
+      it "keeps it" do
+        event = subject.call(severity, time, progname, message)
+        expect(event['@timestamp']).to start_with('2001-01-01T00:00:00')
       end
     end
   end

data/spec/formatter/cee_syslog_spec.rb

@@ -1,43 +1,95 @@
 require 'logstash-logger'
+require_relative '../support/unserializable_value'
 
 describe LogStashLogger::Formatter::CeeSyslog do
   include_context "formatter"
 
-  describe "#call" do
-    let(:facility) { "facility" }
-
-    before do
-      allow(subject).to receive(:build_facility).and_return(facility)
-    end
+  before { subject.error_logger = Logger.new(IO::NULL) }
 
-    it "outputs a facility before the @cee" do
-      expect(formatted_message).to match(/\A#{facility}:@cee:/)
+  describe "#call" do
+    it "outputs this host and the progname before the @cee" do
+      expect(formatted_message).to start_with("#{hostname} #{progname}:@cee:")
     end
 
     it "serializes the LogStash::Event data as JSON" do
-      json_data = formatted_message[/\A#{facility}:@cee:\s?(.*)\Z/, 1]
+      json_data = formatted_message[/\A[^:]*:@cee:\s?(.*)\Z/, 1]
       json_message = JSON.parse(json_data)
       expect(json_message["message"]).to eq(message)
     end
+
+    it "ends the record with exactly one newline" do
+      expect(formatted_message.count("\n")).to eq(1)
+      expect(formatted_message).to end_with("\n")
+    end
+
+    context "without progname" do
+      let(:progname) { nil }
+
+      it "only includes the hostname" do
+        expect(formatted_message).to start_with("#{hostname}:@cee:")
+      end
+    end
   end
 
-  describe "#build_facility" do
-    let(:host) { { 'hostname' => Socket.gethostname } }
+  describe "header" do
+    context "when logged content sets host.hostname" do
+      let(:message) { %q({"message":"hi","host":{"hostname":"web1\n<13>Jan  1 00:00:00 otherhost app: forged"}}) }
+
+      it "uses this process's hostname, not the logged one" do
+        expect(formatted_message).to start_with("#{hostname} #{progname}:@cee:")
+      end
+
+      it "cannot start a second record" do
+        expect(formatted_message.count("\n")).to eq(1)
+        expect(formatted_message).to end_with("\n")
+      end
+    end
+
+    context "when logged content sets host to a String" do
+      let(:message) { %q({"message":"hi","host":"web1"}) }
 
-    before do
-      formatted_message
+      it "formats the record normally" do
+        expect(formatted_message).to start_with("#{hostname} #{progname}:@cee:")
+        expect(JSON.parse(formatted_message[/@cee:(.*)\Z/, 1])['host']).to eq('web1')
+      end
     end
 
-    it "includes hostname and progname" do
-      expect(subject.send(:build_facility, host)).to match(/\A#{host['hostname']}\s#{progname}\z/)
+    context "when the progname contains control characters" do
+      let(:progname) { "app\n<13>forged" }
+
+      it "keeps the header on one line" do
+        expect(formatted_message.count("\n")).to eq(1)
+        expect(formatted_message).to start_with("#{hostname} app <13>forged:@cee:")
+      end
     end
 
-    context "without progname" do
-      let(:progname) { nil }
+    context "when a log call is made while another record is being built" do
+      let(:formatter) { subject }
+      let(:message) do
+        f = formatter
+        Object.new.tap do |obj|
+          obj.define_singleton_method(:inspect) do
+            f.call('INFO', Time.now, 'inner', 'nested')
+            'outer message'
+          end
+        end
+      end
 
-      it "only includes hostname" do
-        expect(subject.send(:build_facility, host)).to match(/\A#{host['hostname']}\z/)
+      it "uses the outer call's progname in the outer header" do
+        expect(subject.call(severity, time, 'outer', message)).to start_with("#{hostname} outer:@cee:")
       end
     end
   end
+
+  describe "when the record cannot be serialized" do
+    let(:message) { { 'message' => 'x', 'n' => UnserializableValue.new } }
+
+    it "emits a placeholder in the same CEE/syslog framing" do
+      expect(formatted_message).to start_with("#{hostname} #{progname}:@cee:")
+      expect(formatted_message.count("\n")).to eq(1)
+      data = JSON.parse(formatted_message[/@cee:(.*)\Z/, 1])
+      expect(data['message']).to eq(LogStashLogger::Formatter::Base::FAILED_TO_FORMAT_MSG)
+      expect(data['tags']).to eq([LogStashLogger::Formatter::Base::FAILED_TO_FORMAT_TAG])
+    end
+  end
 end