title: Difference between fieldname and fieldname.raw in ELK?
body: <p>I have been experimenting with ELK stack for a while now following a few resources on the web. But I didn't find any significant resource that clearly explains the difference between <code>fieldname</code> and <code>fieldname.raw</code> for a field with say name <code>fieldname</code>. </p>
  
  <p>There is nothing much to try in this context but I did try and search this but no luck. The only primary understanding that I have on this is form Kibana window (which I don't know how to reproduce, sadly) that said: <code>fieldname</code> is an analyzed field. There was not such info regarding <code>fieldname.raw</code></p>
  
  <p>One other thing I noticed is that when I use <code>fieldname.raw: "value"</code> in the Kibana4 <strong>Discover</strong> it shows little more results than what I see <code>fieldname: "value"</code>. I could not see which ones were missing since I had 559 and 554 results form these inputs, respectively.</p>
  
  <p>I am guessing the suffix <code>.raw</code> says what it means - It might be a field from the logs itself without any intervention by Logstash. But I want to make sure if that is what it means. If so, then how (and more importantly, why?) did I get less results in an analyzed field? Is there anything that Logstash isn't doing right or is it some kind of misconfiguration? Any pointers are appreciated.</p>