All keywords in the event are mutable, even if they are logstash internal values.

Hi,
I want to highlight one possible source of trouble when working with your pipeline in logstash and this is due to the fact that the event data is mutable. As an example If you have an input that looks like:

``` bash
input {
syslog {
type => "syslog"
}
}
```

and an output section that looks like:

``` bash
output {
if [type] == "syslog" {
stdout {codec => line}
}
}
```

you might expect that the value type stays there in the event from the beginning, through the filter section, and then arriving at the output section so your conditional criteria is meet.

This might not be true if for any case you filter section create a new field with the name `type`, this could happen for example if your syslog line contain a type kv pair.

I think, even if might be understood for most people already due to been the logstash behaviour from beginning, that it might be causing unnecessary problems to the users, specially when this situation is triggered due to having to process new data. It could also provide not an optimal experience when a field is unexpected changes in the process of the event.

I see several ways of fixing this, we could either:
- Document this behaviour so users expect it more clearly.
- Make the "restricted" logstash keywords not mutable.