There is no raw field and that is how I have seen it being done everywhere else.
I'm guessing your index name doesn't start with "logstash-"?
Is there any way of forcing that to be added in logstash? or is that an elasticsearch or kibana thing?
It's an Elasticsearch thing, but done upon request from Logstash's default configuration and the index template it pushes to ES (and that template only matches indexes whose names match logstash-*).