Streaming log pattern-miner — the Drain algorithm clusters raw lines into templates; EWMA flags rate anomalies; both stream live over SSE.