Fix nil panic when overwriting metadata (#24741) (#25180)

Fix panic when overwriting metadata using the  decode_json_fields processor.

(cherry picked from commit ce680e1)

Co-authored-by: Chao <19381524+sincejune@users.noreply.github.com>

CHANGELOG.next.asciidoc

@@ -155,6 +155,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Fix inode removal tracking code when files are replaced by files with the same name {pull}25002[25002]
 - Fix negative Kafka partition bug {pull}25048[25048]
 - Fix bug with annotations dedot config on k8s not used {pull}25111[25111]
+- Fix panic when overwriting metadata {pull}24741[24741]
 
 *Auditbeat*
 

libbeat/common/jsontransform/jsonhelper.go

@@ -79,11 +79,17 @@ func WriteJSONKeys(event *beat.Event, keys map[string]interface{}, expandKeys, o
 		case "@metadata":
 			switch m := v.(type) {
 			case map[string]string:
+				if event.Meta == nil && len(m) > 0 {
+					event.Meta = common.MapStr{}
+				}
 				for meta, value := range m {
 					event.Meta[meta] = value
 				}
 
 			case map[string]interface{}:
+				if event.Meta == nil {
+					event.Meta = common.MapStr{}
+				}
 				event.Meta.DeepUpdate(common.MapStr(m))
 
 			default:

libbeat/processors/actions/decode_json_fields_test.go

@@ -472,6 +472,25 @@ func TestExpandKeysError(t *testing.T) {
 	assert.Equal(t, expected, actual)
 }
 
+func TestOverwriteMetadata(t *testing.T) {
+	testConfig := common.MustNewConfigFrom(map[string]interface{}{
+		"fields":         fields,
+		"target":         "",
+		"overwrite_keys": true,
+	})
+
+	input := common.MapStr{
+		"msg": "{\"@metadata\":{\"beat\":\"libbeat\"},\"msg\":\"overwrite metadata test\"}",
+	}
+
+	expected := common.MapStr{
+		"msg": "overwrite metadata test",
+	}
+	actual := getActualValue(t, testConfig, input)
+
+	assert.Equal(t, expected, actual)
+}
+
 func getActualValue(t *testing.T, config *common.Config, input common.MapStr) common.MapStr {
 	log := logp.NewLogger("decode_json_fields_test")