In general, in a distributed environment, you can install the add-on (TA-eStreamer) in SH/SHC, Indexers/clusters and in Heavyforwarder or universal forwarder, as per respective add-on/app documentation. Also refer to https://docs.splunk.com/Documentation/AddOns/released/Overview/Distributedinstall
There is no harm in installing in indexer tier, as it will not do any parsing (index time), if the sourcetype already goes through a heavy forwarder layer. The add-on is needed on the Search head/SHC for search time parsing and datamodels (if you see them).
In the case of SH, IN and Heavy forwarder tiers, its enough if you deploy this add-on on SH and HF in your case [ we have done the same in our dist setup]. The encore config resides only in HF, which connects to FMC using certs to pull the data.
... View more