[minor] ClusterLogForwarder: noise filters, multiline detection, prune-fields, and dynamic container exclusions

[nikitakumble]

Issue

https://jsw.ibm.com/browse/MASR-6936

Description

Enhances the ClusterLogForwarder configuration for both channel 5.9 and 6.0+ to address log ingestion cost, noise reduction, and operational flexibility in CloudWatch Logs.

Changes

Both channels (5.9 and 6.0+)

• Added instana-agent container/namespace exclusion from application log inputs
• Added run container exclusion from mas-*-core namespace
• Added dynamic additional_exclude_containers templating - operators can now list noisy container/namespace pairs in cluster-params to shut off log forwarding on demand without a code change
• Added non-prod guard to exclude cron container from mas-*-manage namespace
• Added prod/non-prod branching for the noise drop filter:
  • Prod: drops BMX[A-Z0-9]+I info messages
  • Non-prod: additionally drops [CID-CRON-…] and BMXAA8229W messages

6.0+ only

• Added detectMultilineException filter (detect-multiline-errors) to stitch multiline operator/pod logs into a single log record before ingestion - reduces CloudWatch cost significantly
• Added prune-fields filter to strip non-essential metadata fields, retaining only: .message, .log_type, .log_source, .kubernetes.{namespace_name, pod_name, container_name, container_image}, .kubernetes.labels.{app,mas.ibm.com/instanceId}
• Both filters wired into app-logs, infra-logs, and audit-logs pipelines

Testing

• Validated environment-based drop filters and container exclusions behave correctly for both prod and non-prod environments by syncing the CR via ArgoCD and comparing cluster logs against CloudWatch.
• Verified dynamic container exclusions configured via additional_exclude_containers render correctly in the CR and stop the respective container logs from reaching CloudWatch.
• Confirmed multiline exception detection (6.0+ only) stitches multi-line stack traces into a single CloudWatch log record as expected.
• Confirmed prune-fields filter (6.0+ only) strips non-essential metadata fields from log records in CloudWatch, retaining only the required fields.

Related PRs

ibm-mas/cli#2516
https://github.ibm.com/maximoappsuite/saas-tekton/pull/277
https://github.ibm.com/maximoappsuite/saas-deploy-py/pull/298