Thanks. Both methods seem to work as quoted. However, if I try to add colon: "https:.*" to the simple "http_referer", things break. The "http_referer.raw" works better -- it finds hits. But the highlighting in Kibana's interface breaks -- nothing is highlighted.
But, I can live without the highlighting -- and will continue to use the .raw in my searches, however surprising it is, that this is necessary... Thank you!