Analyzed vs not_analyzed

By default, I have a field that is set to not_analyzed. The field contains a string but when using Kibana to do generic searches I have to type the below to find "something" in the string:


I'm thinking that if I create this as analyzed then searching will be a lot simpler?

Does that mean I should use .RAW as a not_analyzed field and fieldLog as Analyzed?

Is there a link on how to enable this?


Link to raw field:

Yes, then no need for wildcard unless you search for part of a word like penc*

Yes if you will do aggregation on fieldLog. If you use only Kibana, it may be more convenient for end users to let fieldLog as not_analyzed and include it in the _all field so that users do not have to use this syntax field:value to search.