Fix nil panic when overwriting metadata

CHANGELOG.next.asciidoc

@@ -241,6 +241,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Allow cgroup self-monitoring to see alternate `hostfs` paths {pull}24334[24334]
 - Fix 'make setup' instructions for a new beat {pull}24944[24944]
 - Fix inode removal tracking code when files are replaced by files with the same name {pull}25002[25002]
+- Fix panic when overwriting metadata {pull}24741[24741]
 
 *Auditbeat*
 

libbeat/common/jsontransform/jsonhelper.go

@@ -77,6 +77,10 @@ func WriteJSONKeys(event *beat.Event, keys map[string]interface{}, expandKeys, o
 			event.Timestamp = ts
 
 		case "@metadata":
+			if event.Meta == nil {
+				event.Meta = common.MapStr{}
+			}
+
 			switch m := v.(type) {
 			case map[string]string:
 				for meta, value := range m {

libbeat/processors/actions/decode_json_fields_test.go

@@ -448,6 +448,25 @@ func TestExpandKeysError(t *testing.T) {
 	assert.Equal(t, expected, actual)
 }
 
+func TestOverwriteMetadata(t *testing.T) {
+	testConfig := common.MustNewConfigFrom(map[string]interface{}{
+		"fields":         fields,
+		"target":         "",
+		"overwrite_keys": true,
+	})
+
+	input := common.MapStr{
+		"msg": "{\"@metadata\":{\"beat\":\"libbeat\"},\"msg\":\"overwrite metadata test\"}",
+	}
+
+	expected := common.MapStr{
+		"msg": "overwrite metadata test",
+	}
+	actual := getActualValue(t, testConfig, input)
+
+	assert.Equal(t, expected, actual)
+}
+
 func getActualValue(t *testing.T, config *common.Config, input common.MapStr) common.MapStr {
 	log := logp.NewLogger("decode_json_fields_test")