The reasoning was that you generally want to ignore those fields that are used in the dynamic values for the GELF fields. So I made the list from the default values for the configurations for those fields. E.g. the default value for the configuration for the GELF `level` field is set to use the `severity` field.

As such, without setting and of those configurations, the event fields `host`, `level`, `line` and `file` are just like any other field. As far as I know `version` was never used to set the GELF version number and should also not be ignored. Similarly, `full_message` is also only known as a GELF field. However, I overlooked `short_message`. With the rest of my changes, this field should be included as the field is used to set the GELF `short_message` field by default now. I'll add that one.

That leaves `timestamp`. In my own configuration, I include that field because I use the `date` filter to use that field to set the event timestamp. But by default, `@timestamp` is simply set to the current time, and a coincidental `timestamp` field again is like any other field.