processors/actions/add_fields: Do not panic if event.Fields is nil map

CHANGELOG-developer.next.asciidoc

@@ -63,6 +63,7 @@ The list below covers the major changes between 7.0.0-rc2 and master only.
 - Fix export dashboard command when running against Elastic Cloud hosted Kibana. {pull}22746[22746]
 - Remove `event.dataset` (ECS) annotion from `libbeat.logp`. {issue}27404[27404]
 - Errors should be thrown as errors. Metricsets inside Metricbeat will now throw errors as the `error` log level. {pull}27804[27804]
+- Avoid panicking in `add_fields` processor when input event.Fields is a nil map. {pull}28219[28219]
 
 ==== Added
 

libbeat/processors/actions/add_fields.go

@@ -73,11 +73,13 @@ func NewAddFields(fields common.MapStr, shared bool, overwrite bool) processors.
 
 func (af *addFields) Run(event *beat.Event) (*beat.Event, error) {
 	fields := af.fields
-	if af.shared {
+	if af.shared || event.Fields == nil {
 		fields = fields.Clone()
 	}
 
-	if af.overwrite {
+	if event.Fields == nil {
+		event.Fields = fields
+	} else if af.overwrite {
 		event.Fields.DeepUpdate(fields)
 	} else {
 		event.Fields.DeepUpdateNoOverwrite(fields)

libbeat/processors/actions/add_fields_test.go

@@ -113,5 +113,12 @@ func TestAddFields(t *testing.T) {
 				`{add_fields: {target: "", fields: {a.change: b}}}`,
 			),
 		},
+		"add fields to nil event": {
+			event: nil,
+			want: common.MapStr{
+				"fields": common.MapStr{"field": "test"},
+			},
+			cfg: single(`{add_fields: {fields: {field: test}}}`),
+		},
 	})
 }

libbeat/processors/actions/common_test.go

@@ -50,7 +50,10 @@ func testProcessors(t *testing.T, cases map[string]testCase) {
 				}
 			}
 
-			current := &beat.Event{Fields: test.event.Clone()}
+			current := &beat.Event{}
+			if test.event != nil {
+				current.Fields = test.event.Clone()
+			}
 			for i, processor := range ps {
 				var err error
 				current, err = processor.Run(current)