Hey @igoriceg
In your OpenSearch configuration file called opensearch.yml. The setting for your Data folder is
path.data: /var/lib/opensearch
I’m not sure why it was set to /opt/opensearch/data/nodes/0/indices
To confirm what I just said, here is an example of mine with default configurations
root@graylog:/etc/graylog/server# cd /var/lib/opensearch
root@graylog:/var/lib/opensearch# ls -al
total 32
drwxr-xr-x 3 opensearch opensearch 4096 Apr 8 19:19 .
drwxr-xr-x 45 root root 4096 Apr 8 21:44 ..
-rw-r--r-- 1 opensearch opensearch 5 Apr 8 21:39 batch_metrics_enabled.conf
-rw-r--r-- 1 opensearch opensearch 5 Apr 8 21:39 logging_enabled.conf
drwxr-xr-x 3 opensearch opensearch 4096 Apr 8 19:19 nodes
-rw-r--r-- 1 opensearch opensearch 4 Apr 8 21:39 performance_analyzer_enabled.conf
-rw-r--r-- 1 opensearch opensearch 4 Apr 8 21:39 rca_enabled.conf
-rw-r--r-- 1 opensearch opensearch 5 Apr 8 21:39 thread_contention_monitoring_enabled.conf
root@graylog:/var/lib/opensearch# cd nodes
root@graylog:/var/lib/opensearch/nodes# ls -al
total 12
drwxr-xr-x 3 opensearch opensearch 4096 Apr 8 19:19 .
drwxr-xr-x 3 opensearch opensearch 4096 Apr 8 19:19 ..
drwxr-xr-x 4 opensearch opensearch 4096 Apr 8 23:23 0
root@graylog:/var/lib/opensearch/nodes# cd 0
root@graylog:/var/lib/opensearch/nodes/0# ls -al
total 16
drwxr-xr-x 4 opensearch opensearch 4096 Apr 8 23:23 .
drwxr-xr-x 3 opensearch opensearch 4096 Apr 8 19:19 ..
drwxr-xr-x 2 opensearch opensearch 4096 Apr 8 21:58 _state
drwxr-xr-x 6 opensearch opensearch 4096 Apr 8 19:33 indices
-rw-r--r-- 1 opensearch opensearch 0 Apr 8 19:19 node.lock
root@graylog:/var/lib/opensearch/nodes/0#
Its not in OpenSearch, its in MongoDb and the database should be called graylog.
Graylog uses MongoDB to store data. Only metadata such as user information and stream configurations are stored here, not log data. So MongoDB will not have a huge system impact. It runs alongside the Graylog server processes and takes up minimal space.
That is from here
It explain what all the functions are for.