Confused about how to use .raw fields and not analyze string fields

What Kibana version are you using?

Assuming it's Kibana 4, you won't see the raw values in "Settings >> Indices" and "Discover", but you should see them in metric selection of "Visualize" (see screenshot). The reason for that is that only Visualize deals with aggregations, where raw values matter.

If you don't see them there, I'd suggest the following:

  • Make sure you're using the default indexing template that comes with Logstash (you shouldn't have to modify it).
  • If you do have to re-index your data, refresh your mappings in Kibana (or delete and re-create the index pattern).