Subscribe to Rails.event once and use config.log_level in create_default_logger

[PetrHeinz]

Two problems with Logtail::Logger.create_default_logger, both reproduced by the red-team on Rails 8.1:

• Every call subscribes another EventLogSubscriber to Rails.event. An app that calls it twice, e.g. in config/application.rb and again in config/environments/production.rb, sends every Rails.event row twice. The red-team's app had two EventLogSubscribers registered after boot.
• The logger's level is DEBUG unless LOG_LEVEL is set. Rails applies config.log_level to Rails.logger while booting, but a logger added later with Rails.logger.broadcast_to(Logtail::Logger.create_default_logger(...)) keeps DEBUG and ships debug lines such as SQL queries. In the red-team's app config.log_level was info, but Rails.logger.level was 0 (debug).

What changes:

• create_default_logger subscribes once. Later calls point the existing subscriber at the new logger, so Rails.event rows go to the logger created last, which is the one the app ends up using. This lives in a new EventLogSubscriber.subscribe(logger), and the subscriber's logger gets a writer.
• The logger's level defaults to the LOG_LEVEL environment variable if it's set (as before), else to Rails.application.config.log_level, else to DEBUG. This is set in Logtail::Logger.create_logger, which create_default_logger builds its logger with, so loggers created directly with create_logger follow config.log_level too.

Behaviour and compatibility:

• In config/application.rb the level isn't final yet, because environment files may still set config.log_level. Rails applies it to Rails.logger in :initialize_logger, so the usual setup behaves as before.
• If an app deliberately creates two default loggers, e.g. for two sources, only the last one receives Rails.event rows now.
• Rails < 8.1 has no Rails.event, so only the level change applies there.

Targets the 0.2.15 patch release. No dependencies.

The commit "Expect real response durations in the request specs" is the same change as in #59: logtail-rack 0.2.8 times responses with the monotonic clock, which Timecop doesn't freeze, so three existing specs now fail on every branch based on main. It's identical in both PRs, so it merges cleanly whichever lands first.

The first commit only adds the tests and is expected to fail on CI. The fix follows in the next commit.

🤖 Generated with Claude Code