Fix nil panic when overwriting metadata (elastic#24741)

sincejune · web-flow · commit ce680e1c147b · 2021-04-20T20:22:50.000+02:00
Fix panic when overwriting metadata using the  decode_json_fields processor.
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -249,6 +249,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Fix `mage GenerateCustomBeat` instructions for a new beat {pull}17679[17679]
 - Fix bug with annotations dedot config on k8s not used {pull}25111[25111]
 - Fix negative Kafka partition bug {pull}25048[25048]
+- Fix panic when overwriting metadata {pull}24741[24741]
 
 *Auditbeat*
 
diff --git a/libbeat/common/jsontransform/jsonhelper.go b/libbeat/common/jsontransform/jsonhelper.go
@@ -79,11 +79,17 @@ func WriteJSONKeys(event *beat.Event, keys map[string]interface{}, expandKeys, o
 		case "@metadata":
 			switch m := v.(type) {
 			case map[string]string:
+				if event.Meta == nil && len(m) > 0 {
+					event.Meta = common.MapStr{}
+				}
 				for meta, value := range m {
 					event.Meta[meta] = value
 				}
 
 			case map[string]interface{}:
+				if event.Meta == nil {
+					event.Meta = common.MapStr{}
+				}
 				event.Meta.DeepUpdate(common.MapStr(m))
 
 			default:
diff --git a/libbeat/processors/actions/decode_json_fields_test.go b/libbeat/processors/actions/decode_json_fields_test.go
@@ -472,6 +472,25 @@ func TestExpandKeysError(t *testing.T) {
 	assert.Equal(t, expected, actual)
 }
 
+func TestOverwriteMetadata(t *testing.T) {
+	testConfig := common.MustNewConfigFrom(map[string]interface{}{
+		"fields":         fields,
+		"target":         "",
+		"overwrite_keys": true,
+	})
+
+	input := common.MapStr{
+		"msg": "{\"@metadata\":{\"beat\":\"libbeat\"},\"msg\":\"overwrite metadata test\"}",
+	}
+
+	expected := common.MapStr{
+		"msg": "overwrite metadata test",
+	}
+	actual := getActualValue(t, testConfig, input)
+
+	assert.Equal(t, expected, actual)
+}
+
 func getActualValue(t *testing.T, config *common.Config, input common.MapStr) common.MapStr {
 	log := logp.NewLogger("decode_json_fields_test")
 
