diff --git a/CHANGELOG-developer.next.asciidoc b/CHANGELOG-developer.next.asciidoc
index 4b89ac3260a..da38709b9bb 100644
--- a/CHANGELOG-developer.next.asciidoc
+++ b/CHANGELOG-developer.next.asciidoc
@@ -60,6 +60,7 @@ The list below covers the major changes between 7.0.0-rc2 and master only.
 - Fix export dashboard command when running against Elastic Cloud hosted Kibana. {pull}22746[22746]
 - Remove `event.dataset` (ECS) annotion from `libbeat.logp`. {issue}27404[27404]
 - Errors should be thrown as errors. Metricsets inside Metricbeat will now throw errors as the `error` log level. {pull}27804[27804]
+- Avoid panicking in `add_fields` processor when input event.Fields is a nil map. {pull}28219[28219]
 
 ==== Added
 
diff --git a/libbeat/processors/actions/add_fields.go b/libbeat/processors/actions/add_fields.go
index 3d39c1afb4d..d2dd2d6e867 100644
--- a/libbeat/processors/actions/add_fields.go
+++ b/libbeat/processors/actions/add_fields.go
@@ -73,11 +73,13 @@ func NewAddFields(fields common.MapStr, shared bool, overwrite bool) processors.
 
 func (af *addFields) Run(event *beat.Event) (*beat.Event, error) {
 	fields := af.fields
-	if af.shared {
+	if af.shared || event.Fields == nil {
 		fields = fields.Clone()
 	}
 
-	if af.overwrite {
+	if event.Fields == nil {
+		event.Fields = fields
+	} else if af.overwrite {
 		event.Fields.DeepUpdate(fields)
 	} else {
 		event.Fields.DeepUpdateNoOverwrite(fields)
diff --git a/libbeat/processors/actions/add_fields_test.go b/libbeat/processors/actions/add_fields_test.go
index a0b7b1d37dc..41a0e75d5c9 100644
--- a/libbeat/processors/actions/add_fields_test.go
+++ b/libbeat/processors/actions/add_fields_test.go
@@ -113,5 +113,12 @@ func TestAddFields(t *testing.T) {
 				`{add_fields: {target: "", fields: {a.change: b}}}`,
 			),
 		},
+		"add fields to nil event": {
+			event: nil,
+			want: common.MapStr{
+				"fields": common.MapStr{"field": "test"},
+			},
+			cfg: single(`{add_fields: {fields: {field: test}}}`),
+		},
 	})
 }
diff --git a/libbeat/processors/actions/common_test.go b/libbeat/processors/actions/common_test.go
index 4c4a294970b..f733c90450a 100644
--- a/libbeat/processors/actions/common_test.go
+++ b/libbeat/processors/actions/common_test.go
@@ -50,7 +50,10 @@ func testProcessors(t *testing.T, cases map[string]testCase) {
 				}
 			}
 
-			current := &beat.Event{Fields: test.event.Clone()}
+			current := &beat.Event{}
+			if test.event != nil {
+				current.Fields = test.event.Clone()
+			}
 			for i, processor := range ps {
 				var err error
 				current, err = processor.Run(current)