How to transform fields but dont insert them into elasticsearch

[Badger]

@Josep_Soler

mutate { remove_field => [ "path", "host","@version", "@timestamp", "indexName" ] }

You are deleting [indexName] before the event gets to the output. So the sprintf reference to %{indexName} does not get substituted.

Also, you are using %{+YYYY.MM.dd} in the index name, which is a reference to [@timestamp,] but you have also deleted that, so that does not get substituted.

Lastly, if I recall correctly, [@timestamp] is not optional for elasticsearch. I believe it will fail to index events that do not have that field.