Regular expressions and non-analyzed fields

Elastic Stack Elasticsearch
1

What is the default behaviour for a regexp query against a non-analyzed field? Also, is that the same answer when dealing with .raw fields?

After everything i've read, i understand the following.

  1. RegExp queries will work on analyzed and non-analyzed fields.
  2. A regexp query should work across the entire phrase rather than just matching on a single token in non-analyzed fields.
    Here's the problem though. I can not actually get this to work. I've tried it across multiple fields.

The setup i'm working with is a stock elk install and i'm dumping pfsense and snort logs into it with a basic parser. I'm currently on Kibana 4.3 and ES 2.1

I did a query to look at the mapping for one of the fields and it indicates it is not_analyzed, yet the regex does not work across the entire field.

indent preformatted text by 4 spaces
"description" : {
"type" : "string",
"norms" : {
"enabled" : false
},
"fields" : {
"raw" : {
"type" : "string",
"index" : "not_analyzed",
"ignore_above" : 256
}
}
},

What am i missing here?