fix: do not overwrite GELF internal fields

Fixes logstash-plugins#25

CHANGELOG.md

@@ -1,3 +1,6 @@
+## next
+  - Fix: avoid GELF internal fields when removing leading underscores
+
 ## 3.3.2
   - Fix: avoid panic when handling very-large exponent-notation `_@timestamp` values [#71](https://github.com/logstash-plugins/logstash-input-gelf/pull/71)
 

lib/logstash/inputs/gelf.rb

@@ -272,7 +272,10 @@ def remap_gelf(event)
   def strip_leading_underscore(event)
     # Map all '_foo' fields to simply 'foo'
     event.to_hash.keys.each do |key|
-      move_field(event, key, key.slice(1..-1)) if key.start_with?('_')
+      next unless key.start_with?('_')
+      destination_field = key.slice(1..-1)
+      next if %w[version host short_message full_message timestamp level facility line file].include? destination_field # GELF inner fields
+      move_field(event, key, key.slice(1..-1))
     end
   end
 

spec/inputs/gelf_spec.rb

@@ -268,8 +268,8 @@ def client_bootstrap(gelfclient, queue)
       gelfclient.notify!("short_message" => message, "_level" => "foo")
       e = queue.pop
       expect(e.get("message")).to eq(message)
-      # TODO fixme, level should contain a number and _level should keep the leading underscore
-      expect(e.get("level")).to eq("foo")
+      expect(e.get("level")).to eq(1) # default
+      expect(e.get("_level")).to eq("foo")
     end
   end
 end