The Log Feeder component parses component logs. A Log Feeder is deployed to every node in the cluster and is aware of the location and format of all component logs on that host. When started, the Log Feeder starts parsing all known component logs, and sends those logs to the Apache Solr instances, managed by the Ambari Infra service, to be indexed.

By default, only FATAL,ERROR, and WARN level logs are captured by the Log Feeder. Log levels beyond FATAL,ERROR, and WARN can be temporarily or permanently added using either the Log Search UI's filter settings (for temporary log level capture), or through the Log Search configuration in Ambari.