When a document is deleted in OpenSearch it is marked for deletion. It is not physically removed from storage until a merge removes the document(s) from the segments underlying the index shards.
This only applies when documents are being deleted from an index. If an entire index is deleted the delete is immediate. Deleting an index doesn't create any delete markers.
To determine the number of documents marked for deletion in indices you can either
- Run the
GET _cat/indices?vAPI looking at the docs.deleted field
OR
- Look at the DeletedDocuments metric in CloudWatch
If you have indices with document marked for deletion you can expunge the deleted documents using the force merge API with the only_expunge_deletes parameter.
Run the POST /<index-name>/_forcemerge?only_expunge_deletes=true API to expunge the deleted documents.
Note the force merge operation triggers an I/O intensive process and blocks all new requests to your cluster until the merge is complete. Only call the force merge operation against read-only indices, when no additional data is being written to the index.
Go to the Example section of this repository for instructions on how to run an example that will demonstrate these concepts