title: Where do .raw fields come from when using Logstash with Elasticsearch output?
body: <p>When using Logstash and Elasticsearch together, fields with <code>.raw</code> are appended for analyzed fields, so that when querying Elasticsearch with tools like Kibana, it's possible to use the field's value as-is without per-word splitting and what not.</p>
  
  <p>I built a new installation of the ELK stack with the latest greatest versions of everything, and noticed my <code>.raw</code> fields are no longer being created as they were on older versions of the stack.  There are a lot of <a href="https://stackoverflow.com/a/27502037/362536">folks posting solutions of creating templates on Elasticsearch</a>, but I haven't been able to find much information as to <em>why</em> this fixes things.  In an effort to better understand the broader problem, I ask this specific question:</p>
  
  <p><strong>Where do the .raw fields come from?</strong></p>
  
  <p>I had assumed that Logstash was populating Elasticsearch with strings as-analyzed and strings as-raw when it inserted documents, but considering the fact that the fix lies in Elasticsearch templates, I question whether or not my assumption is correct.</p>