diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
index 793c94615b11..04fc231a65a5 100644
--- a/CHANGELOG.next.asciidoc
+++ b/CHANGELOG.next.asciidoc
@@ -189,6 +189,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Add fix to parse syslog message with priority value 0. {issue}11010[11010]
 - Don't apply multiline rules in Logstash json logs. {pull}11346[11346]
 - Fix coredns image in docs.asciidoc for docs build. {pull}11460[11460] {pull}11461[11461]
+- Fix panic in add_kubernetes_metadata processor when key `log` does not exist. {issue}11543[11543] {pull}11549[11549]
 
 *Heartbeat*
 
diff --git a/filebeat/processor/add_kubernetes_metadata/matchers.go b/filebeat/processor/add_kubernetes_metadata/matchers.go
index c984c0f60e6e..b95ea7101f6f 100644
--- a/filebeat/processor/add_kubernetes_metadata/matchers.go
+++ b/filebeat/processor/add_kubernetes_metadata/matchers.go
@@ -77,7 +77,8 @@ const containerIdLen = 64
 const podUIDPos = 5
 
 func (f *LogPathMatcher) MetadataIndex(event common.MapStr) string {
-	if value, ok := event["log"].(common.MapStr)["file"].(common.MapStr)["path"]; ok {
+	value, err := event.GetValue("log.file.path")
+	if err == nil {
 		source := value.(string)
 		logp.Debug("kubernetes", "Incoming log.file.path value: %s", source)