OpenSearch Index Life Cycle Policy

Question

I have a new instance of OpenSearch set up in my account. Over time, I've noticed that my index, roles, and role mappings are being automatically erased. Could this be due to a default lifecycle policy in OpenSearch that removes data after a certain period?

Answer 1

The lifecycle policy in Opensearch called index state management aka ISM. By default, there is no delete action for any index. Also, it's not possible to define to delete role or role mapping with ISM. You can check if an index has defined ISM policy with the following API call.

EXAMPLE REQUEST

GET _plugins/_ism/explain/index_1

EXAMPLE RESPONSE

{
  "index_1": {
    "index.plugins.index_state_management.policy_id": "policy_1"
  }
}

https://opensearch.org/docs/latest/im-plugin/ism/api/#explain-index

To diagnose the reason of erase maybe you can check opensearch logs. Each removed index must have logs in opensearch.