Log Search is a built-in service in Ambari 2.4 and later. You can add it during a new installation by using the +Add Service menu. The Log Feeders are automatically installed on all nodes in the cluster; you manually place the Log Search Server, optionally on the same server as the Ambari Server.