Log Search is a built-in service in Ambari 2.4 and can be added during a new installation using the +Add Service menu. The Log Feeders will be automatically installed on all nodes in the cluster; there is no need to selectively place them on specific hosts. The Log Search Server can be placed on any host in the cluster, but it is recommended to be installed on the same server as the Ambari Server.