Hi people!!
Don't know why but my latest logstash/elasticsearch/kibana are not using the .raw fields (I guess that it is true by default isnt?).
The real problem is that my string fields are been split by the spaces on the data.
Can someone help me?
Those fields are created by ES thanks to the LS template.
So check the _templates endpoint in ES to make sure you have a matching one 
Are you using the default logstash indexing ? (default template?)
I suspect you've changed the index name with the elasticsearch output's index option. Note that Logstash's default index template only applies to indexes whose names match logstash-*.