diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index e959f917da2..bca96293df0 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -249,6 +249,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Fix `mage GenerateCustomBeat` instructions for a new beat {pull}17679[17679] - Fix bug with annotations dedot config on k8s not used {pull}25111[25111] - Fix negative Kafka partition bug {pull}25048[25048] +- Fix panic when overwriting metadata {pull}24741[24741] *Auditbeat* diff --git a/libbeat/common/jsontransform/jsonhelper.go b/libbeat/common/jsontransform/jsonhelper.go index d52939c6922..11d42eefcbb 100644 --- a/libbeat/common/jsontransform/jsonhelper.go +++ b/libbeat/common/jsontransform/jsonhelper.go @@ -79,11 +79,17 @@ func WriteJSONKeys(event *beat.Event, keys map[string]interface{}, expandKeys, o case "@metadata": switch m := v.(type) { case map[string]string: + if event.Meta == nil && len(m) > 0 { + event.Meta = common.MapStr{} + } for meta, value := range m { event.Meta[meta] = value } case map[string]interface{}: + if event.Meta == nil { + event.Meta = common.MapStr{} + } event.Meta.DeepUpdate(common.MapStr(m)) default: diff --git a/libbeat/processors/actions/decode_json_fields_test.go b/libbeat/processors/actions/decode_json_fields_test.go index 8b65d26224c..73d4f3a5fcc 100644 --- a/libbeat/processors/actions/decode_json_fields_test.go +++ b/libbeat/processors/actions/decode_json_fields_test.go @@ -472,6 +472,25 @@ func TestExpandKeysError(t *testing.T) { assert.Equal(t, expected, actual) } +func TestOverwriteMetadata(t *testing.T) { + testConfig := common.MustNewConfigFrom(map[string]interface{}{ + "fields": fields, + "target": "", + "overwrite_keys": true, + }) + + input := common.MapStr{ + "msg": "{\"@metadata\":{\"beat\":\"libbeat\"},\"msg\":\"overwrite metadata test\"}", + } + + expected := common.MapStr{ + "msg": "overwrite metadata test", + } + actual := getActualValue(t, testConfig, input) + + assert.Equal(t, expected, actual) +} + func getActualValue(t *testing.T, config *common.Config, input common.MapStr) common.MapStr { log := logp.NewLogger("decode_json_fields_test")