[Cloud Security] Injest now copies cluster_id -> orchestrator.cluster…

….id if null (due to pre 8.8.0 agents) (#7185)

* injest now copies cluster_id -> orchestrator.cluster.id if null

pr link updated

Merged with main

* using copy_from instead of value

packages/cloud_security_posture/changelog.yml

@@ -4,7 +4,11 @@
 # 1.4.x - 8.9.x
 # 1.3.x - 8.8.x
 # 1.2.x - 8.7.x
-
+- version: "1.5.0-preview28"
+  changes:
+    - description: Added ingest processor to copy cluster_id to orchestrator.cluster.id
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/7185
 - version: "1.5.0-preview27"
   changes:
     - description: Seperate KSPM and CSPM cloudformation templates

packages/cloud_security_posture/data_stream/findings/elasticsearch/ingest_pipeline/default.yml

@@ -9,6 +9,11 @@ processors:
     value: 'kspm'
     description: 'Backward compatibility cloudbeat version < 8.7'
     if: ctx.rule?.benchmark?.posture_type == null
+- set:
+    field: orchestrator.cluster.id
+    copy_from: cluster_id
+    description: 'Backward compatibility cloudbeat version < 8.8'
+    if: ctx.orchestrator?.cluster?.id == null
 on_failure:
 - set:
     field: error.message

packages/cloud_security_posture/manifest.yml

@@ -1,7 +1,7 @@
 format_version: 2.3.0
 name: cloud_security_posture
 title: "Security Posture Management"
-version: "1.5.0-preview27"
+version: "1.5.0-preview28"
 source:
   license: "Elastic-2.0"
 description: "Identify & remediate configuration risks in your Cloud infrastructure"