LogSearch service includes three major components:
- A Solr cloud to store logs and query
- Log collectors/feeders that consume log files being generated by the services
- Log search service that provides REST API and UI front end
The above components are managed by Ambari through a stack definition. The stack definition provides the mechanism to have the LogSearch service configured to read log files created by other services, including Ambari Server. This integration allows customizing log locations and letting LogSearch service be aware of the locations.
Final peace is to provide an integration from the Ambari UI to LogSearch service so that the logs for a service is easily accessible from the service dashboards.