Updated fix to Do not strip leading underscore from fields conflicting with GELF fields

CHANGELOG.md

@@ -1,3 +1,6 @@
+## next
+  - Fix: avoid GELF internal fields when removing leading underscores
+
 ## 3.3.2
   - Fix: avoid panic when handling very-large exponent-notation `_@timestamp` values [#71](https://github.com/logstash-plugins/logstash-input-gelf/pull/71)
 

lib/logstash/inputs/gelf.rb

@@ -272,7 +272,10 @@ def remap_gelf(event)
   def strip_leading_underscore(event)
     # Map all '_foo' fields to simply 'foo'
     event.to_hash.keys.each do |key|
-      move_field(event, key, key.slice(1..-1)) if key.start_with?('_')
+      next unless key.start_with?('_')
+      destination_field = key.slice(1..-1)
+      next if %w[version host short_message full_message timestamp level facility line file].include? destination_field # GELF inner fields
+      move_field(event, key, key.slice(1..-1))
     end
   end
 

spec/inputs/gelf_spec.rb

@@ -238,4 +238,38 @@ def client_bootstrap(gelfclient, queue)
       end
     end
   end
+
+  describe "when handling complex messages" do
+    let(:host) { "127.0.0.1" }
+    let(:port) { 12211 }
+    let(:chunksize) { 1420 }
+    let(:gelfclient) { GELF::Notifier.new(host, port, chunksize) }
+
+    let(:config) { { "port" => port, "host" => host } }
+    let(:queue) { Queue.new }
+
+    subject(:gelf_input) { described_class.new(config) }
+
+    before(:each) do
+      subject.register
+      @runner = Thread.new { subject.run(queue) }
+
+      client_bootstrap(gelfclient, queue)
+    end
+
+    after(:each) do
+      subject.do_stop
+      @runner.kill
+      @runner.join
+    end
+
+    it "should not overwrite inner gelf fields" do
+      message = "level field conflicting with internal GELF level field"
+      gelfclient.notify!("short_message" => message, "_level" => "foo")
+      e = queue.pop
+      expect(e.get("message")).to eq(message)
+      expect(e.get("level")).to eq(1) # default
+      expect(e.get("_level")).to eq("foo")
+    end
+  end
 end