Dashboard tenant indices duplications found not matching official spec

OpenSearch Dashboards
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):
2.4.1

Describe the issue:

My company is using the security plugin with multi tenancy support, so each tenant can have their own private saved objects.

Recently I ran into a problem where the index patterns for hundreds of tenants needed to be updated on the Dashboard. Since there is no official saved objects api, I added the new index pattern and left the old one dangling. This is not pretty however and leaves our customers confused.

I knew from the following page: OpenSearch Dashboards multi-tenancy - OpenSearch documentation
that each tenant has his own hidden index where the saved objects are stored. I figured that I could simply remove the matching documents with the old index pattern saved object and remove them.

To my surprise, I found duplicate indices for tenants containing duplicates of the saved objects. The indices I found look like the following:

.kibana_HASH_mytenant_1
.kibana_HASH_mytenant_2
.kibana_HASH_mytenant_3
.kibana_HASH_mytenant_4

This does not match the documented behavior:

.kibana_<hash>_<tenant_name>
.kibana_<hash>_<username>

What does this postfix number on the index name represent and how does OpenSearch Dashboard know which saved object when there are duplicates?

2

It aliases the .kibana_hash_username to the latest .kibana_hash_username_N.
ie: .kibana_123456_jrojas => .kibana_1234567788_jrojas_5
etc.

3

Thanks for that insight. I found the alias and that surely will help me in my case.

However what logic determines the N postfix? We only created our tenants once.

4

I think opensearch-dashboards “upgrades” the index and then increments the _Number as it upgrades.

5

Makes sense as we’ve upgraded quite a few versions since. Thanks for the help Jason!