Prevent field @timestamp from being removed

Fixes #4425

logstash-core-event/lib/logstash/event.rb

@@ -179,6 +179,9 @@ class LogStash::Event
 
   # Remove a field or field reference. Returns the value of that field when deleted
   def remove(fieldref)
+    if fieldref == TIMESTAMP || fieldref == "[#{TIMESTAMP}]"
+      raise TypeError, "The field '@timestamp' must not be removed"
+    end
     @accessors.del(fieldref)
   end
 

logstash-core-event/spec/logstash/event_spec.rb

@@ -101,7 +101,7 @@ describe LogStash::Event do
       it "should raise error when formatting %{+%s} when @timestamp field is missing" do
         str = "hello-%{+%s}"
         subj = subject.clone
-        subj.remove("[@timestamp]")
+        subj.instance_variable_get(:@accessors).del("[@timestamp]")
         expect{ subj.sprintf(str) }.to raise_error(LogStash::Error)
       end
 
@@ -118,7 +118,7 @@ describe LogStash::Event do
       it "should raise error with %{+format} syntax when @timestamp field is missing", :if => RUBY_ENGINE == "jruby" do
         str = "logstash-%{+YYYY}"
         subj = subject.clone
-        subj.remove("[@timestamp]")
+        subj.instance_variable_get(:@accessors).del("[@timestamp]")
         expect{ subj.sprintf(str) }.to raise_error(LogStash::Error)
       end
 
@@ -333,6 +333,12 @@ describe LogStash::Event do
           expect(subject[ "field1" ]).to eq([ "original1", "original2", "append1" ])
         end
       end
+
+      context "remove" do
+        it "should raise an exception if you attempt to remove @timestamp" do
+          expect{subject.remove("@timestamp")}.to raise_error(TypeError)
+        end
+      end
     end
 
     it "timestamp parsing speed", :performance => true do