injest now copies cluster_id -> orchestrator.cluster.id if null

mitodrummer · mitodrummer · commit 981409a56544 · 2023-07-31T16:55:53.000Z
pr link updated

Merged with main
diff --git a/packages/cloud_security_posture/changelog.yml b/packages/cloud_security_posture/changelog.yml
@@ -4,7 +4,11 @@
 # 1.4.x - 8.9.x
 # 1.3.x - 8.8.x
 # 1.2.x - 8.7.x
-
+- version: "1.5.0-preview28"
+  changes:
+    - description: Added ingest processor to copy cluster_id to orchestrator.cluster.id
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/7185
 - version: "1.5.0-preview27"
   changes:
     - description: Seperate KSPM and CSPM cloudformation templates
diff --git a/packages/cloud_security_posture/data_stream/findings/elasticsearch/ingest_pipeline/default.yml b/packages/cloud_security_posture/data_stream/findings/elasticsearch/ingest_pipeline/default.yml
@@ -9,6 +9,11 @@ processors:
     value: 'kspm'
     description: 'Backward compatibility cloudbeat version < 8.7'
     if: ctx.rule?.benchmark?.posture_type == null
+- set:
+    field: orchestrator.cluster.id
+    value: ctx.cluster_id
+    description: 'Backward compatibility cloudbeat version < 8.8'
+    if: ctx.orchestrator?.cluster?.id == null
 on_failure:
 - set:
     field: error.message
diff --git a/packages/cloud_security_posture/manifest.yml b/packages/cloud_security_posture/manifest.yml
@@ -1,7 +1,7 @@
 format_version: 2.3.0
 name: cloud_security_posture
 title: "Security Posture Management"
-version: "1.5.0-preview27"
+version: "1.5.0-preview28"
 source:
   license: "Elastic-2.0"
 description: "Identify & remediate configuration risks in your Cloud infrastructure"
