[processor/drain] add new drain processor for log template annotation

[MikeGoldsmith]

Closes #47235

Overview

Adds processor/drain, which applies the Drain log clustering algorithm to annotate log records with a derived template string.

Attribute	Type	Example
log.record.template	string	"user <*> logged in from <*>"

The processor annotates only — it does not filter. Use the filter processor downstream to act on the template attribute.

Key features

• Configurable parse tree parameters: tree_depth, merge_threshold, max_node_children, max_clusters (LRU eviction)
• Optional body_field extraction for structured (map) log bodies
• Pre-seeding via seed_templates or seed_logs for stable templates across restarts
• Optional warmup_min_clusters: trains from the first record but suppresses annotation until N distinct clusters are observed — records pass through immediately, no buffering or added latency
• Internal telemetry: processor_drain_clusters_active gauge, processor_drain_log_records_annotated and processor_drain_log_records_unannotated counters

Dependencies

This processor introduces one new third-party dependency:

Module	Version	Licence	Purpose
github.com/Jaeyo/go-drain3	v0.1.2	MIT	Drain algorithm implementation

go-drain3 is a Go port of the Python Drain3 reference library. It was chosen for its complete implementation of the algorithm including JSON marshal/unmarshal hooks, which are the foundation for future snapshot persistence support.

Test plan

• Unit tests covering annotation, seeding, warmup suppression, custom attribute name, body field extraction, empty body skipping, multi-resource batches
• Race detector clean (go test -race ./...)
• Linter clean (golangci-lint run ./...)
• Generated files produced by mdatagen

Changes from initial proposal (post-SIG 2026-04-01)

• Library: corrected to jaeyo/go-drain3 (was incorrectly listed as faceair/drain)
• Buffer warmup mode removed: held records in memory until tree stabilised — incompatible with collector latency requirements
• warmup_min_clusters introduced as a zero-latency alternative: suppresses annotation during warmup without buffering
• Config renames: log_cluster_depth → tree_depth, sim_threshold → merge_threshold, max_children → max_node_children — algorithm names referenced in docs
• Sponsor: @atoulme

[edmocosta]

As per our new component policy, we need at least three code owners for your component to be accepted. If @atoulme is willing to be the second one, we'd still need to find a third one to meet that requirement.

[MikeGoldsmith]

Thanks @edmocosta - I'll keep looking for other contributors who would be interested in supporting this component.