I’m guessing that it wrote to your “default” tenant (“namespace”).
Here is a comment related to this:
You can find out which tenants you have access to through _opendistro/_security/api/account?pretty
I’m guessing that -H "securitytenant: global_tenant"\ is wrong and it should be 'global_tenant' with citation marks.
I have not tested any of this.