How do I create an index name based on a time field that is not the timestamp?

Assuming you don't want to use the @timestamp field for the post date you need to transform the [page][post_date] field (or a copy of it) into whatever format you prefer (using grok, mutate, or whatever filters you prefer) and reference it in the index option with the %{fieldname} notation.

1 Like