I would like to create an unanalyzed *.raw field for every string field in my customer indexes. I note that default logstash indexes have the *.raw field always. Am I able to add the raw field retroactively and how do I do this for going forward? This will be both for indexes created daily and indexes that are not dated.
You can't add such a subfield retroactively; you have to reindex. To fix it for indexes created in the future, adjust any index templates or, if you don't use index templates, the index creation request. If you currently don't define any explicit mappings for your indexes it's time to start doing that.