From 0f0e71cc8c34136a90cee780f7b1fee43238e223 Mon Sep 17 00:00:00 2001 From: Charly Koza Date: Wed, 14 Sep 2016 15:29:55 +0200 Subject: [PATCH] avoid fields with underscore from overriding GELF field fixes https://github.com/logstash-plugins/logstash-input-gelf/issues/25 --- lib/logstash/inputs/gelf.rb | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/lib/logstash/inputs/gelf.rb b/lib/logstash/inputs/gelf.rb index ec9443d..7f4768d 100644 --- a/lib/logstash/inputs/gelf.rb +++ b/lib/logstash/inputs/gelf.rb @@ -192,7 +192,11 @@ def strip_leading_underscore(event) # Map all '_foo' fields to simply 'foo' event.to_hash.keys.each do |key| next unless key[0,1] == "_" - event.set(key[1..-1], event.get(key)) + new_key = key[1..-1] + # https://github.com/logstash-plugins/logstash-input-gelf/issues/25 + next if ['version', 'host', 'short_message', 'full_message', 'timestamp', 'level', 'facility', 'line', 'file'].include? new_key # GELF inner fields + next if ['type'].include? new_key # Logstash fields + event.set(new_key, event.get(key)) event.remove(key) end end # deef removing_leading_underscores