title: Kibana is not showing any values of .raw fields
body: <p>i am using kibana 4 and it is showing .raw field i.e result.raw in list of fields along with result.<br>
  i have checked my elasticsearch indices mapping and they are also showing raw fields.<br>
  then why kiban is not showing any values of those raw field(It was showing from past 15 days but yesterday i put some more grok pattern in my logstash config file from that time it stopped showing me those value. Now it is not showing .raw field value for past data as well and the pattern i put was working fine and giving analyzed field value but not .raw field)<br><br></p>
  
  <p><br>
  <br></p>
  
  <pre><code>curl -XGET 'localhost:9200/logstash-2015.09.25?pretty'&lt;br&gt;&lt;br&gt;
     {
       "logstash-2015.09.25" : {
           "aliases" : { },
           "mappings" : {
           "_default_" : {
           "dynamic_templates" : [ {
           "message_field" : {
           "mapping" : {
           "index" : "analyzed",
           "omit_norms" : true,
           "type" : "string"
          },
          "match" : "message",
          "match_mapping_type" : "string"
        }
      }, {
        "string_fields" : {
          "mapping" : {
            "index" : "analyzed",
            "omit_norms" : true,
            "type" : "string",
            "fields" : {
              "raw" : {
                "index" : "not_analyzed",
                "ignore_above" : 256,
                "type" : "string"
              }
            }
          },
          "match" : "*",
          "match_mapping_type" : "string"
        }
      } ],
      "_all" : {
        "enabled" : true,
        "omit_norms" : true
      },
      "properties" : {
        "@version" : {
          "type" : "string",
          "index" : "not_analyzed"
        },
        "geoip" : {
          "dynamic" : "true",
          "properties" : {
            "location" : {
              "type" : "geo_point"
            }
          }
        }
      }
    },
    "scan_production" : {
      "dynamic_templates" : [ {
        "message_field" : {
          "mapping" : {
            "index" : "analyzed",
            "omit_norms" : true,
            "type" : "string"
          },
          "match" : "message",
          "match_mapping_type" : "string"
        }
      }, {
        "string_fields" : {
          "mapping" : {
            "index" : "analyzed",
            "omit_norms" : true,
            "type" : "string",
            "fields" : {
              "raw" : {
                "index" : "not_analyzed",
                "ignore_above" : 256,
                "type" : "string"
              }
            }
          },
          "match" : "*",
          "match_mapping_type" : "string"
        }
      } ],
      "_all" : {
        "enabled" : true,
        "omit_norms" : true
      },
      "properties" : {
        "@timestamp" : {
          "type" : "date",
          "format" : "dateOptionalTime"
        },
        "@version" : {
          "type" : "string",
          "index" : "not_analyzed"
        },
        "command" : {
          "type" : "string",
          "norms" : {
            "enabled" : false
          },
          "fields" : {
            "raw" : {
              "type" : "string",
              "index" : "not_analyzed",
              "ignore_above" : 256
            }
          }
        },
        "file" : {
          "type" : "string",
          "norms" : {
            "enabled" : false
          },
          "fields" : {
            "raw" : {
              "type" : "string",
              "index" : "not_analyzed",
              "ignore_above" : 256
            }
          }
        },
        "geoip" : {
          "dynamic" : "true",
          "properties" : {
            "location" : {
              "type" : "geo_point"
            }
          }
        },
        "host" : {
          "type" : "string",
          "norms" : {
            "enabled" : false
          },
          "fields" : {
            "raw" : {
              "type" : "string",
              "index" : "not_analyzed",
              "ignore_above" : 256
            }
          }
        },
        "id" : {
          "type" : "string",
          "norms" : {
            "enabled" : false
          },
          "fields" : {
            "raw" : {
              "type" : "string",
              "index" : "not_analyzed",
              "ignore_above" : 256
            }
          }
        },
        "message" : {
          "type" : "string",
          "norms" : {
            "enabled" : false
          }
        },
        "message_type" : {
          "type" : "string",
          "norms" : {
            "enabled" : false
          },
          "fields" : {
            "raw" : {
              "type" : "string",
              "index" : "not_analyzed",
              "ignore_above" : 256
            }
          }
        },
        "offset" : {
          "type" : "string",
          "norms" : {
            "enabled" : false
          },
          "fields" : {
            "raw" : {
              "type" : "string",
              "index" : "not_analyzed",
              "ignore_above" : 256
            }
          }
        },
        "received_at" : {
          "type" : "date",
          "format" : "dateOptionalTime"
        },
        "received_from" : {
          "type" : "string",
          "norms" : {
            "enabled" : false
          },
          "fields" : {
            "raw" : {
              "type" : "string",
              "index" : "not_analyzed",
              "ignore_above" : 256
            }
          }
        },
        "result" : {
          "type" : "string",
          "norms" : {
            "enabled" : false
          },
          "fields" : {
            "raw" : {
              "type" : "string",
              "index" : "not_analyzed",
              "ignore_above" : 256
            }
          }
        },
        "severity" : {
          "type" : "string",
          "norms" : {
            "enabled" : false
          },
          "fields" : {
            "raw" : {
              "type" : "string",
              "index" : "not_analyzed",
              "ignore_above" : 256
            }
          }
        },
        "tags" : {
          "type" : "string",
          "norms" : {
            "enabled" : false
          },
          "fields" : {
            "raw" : {
              "type" : "string",
              "index" : "not_analyzed",
              "ignore_above" : 256
            }
          }
        },
        "timestamp" : {
          "type" : "date",
          "format" : "dateOptionalTime"
        },
        "type" : {
          "type" : "string",
          "norms" : {
            "enabled" : false
          },
          "fields" : {
            "raw" : {
              "type" : "string",
              "index" : "not_analyzed",
              "ignore_above" : 256
            }
          }
        }
      }
    },
  "settings" : {
    "index" : {
      "creation_date" : "1443139268796",
      "uuid" : "qJyyA60ZSpGY2CuBfoG8JQ",
      "number_of_replicas" : "1",
      "number_of_shards" : "5",
      "refresh_interval" : "5s",
      "version" : {
        "created" : "1040599"
      }
    }
  },
  "warmers" : { }
    }
   }
  </code></pre>
  
  <p><br>
    cat /etc/logstash/conf.d/lumberjack.conf</p>
  
  <pre><code>input {
    lumberjack {
    port =&gt; 5000
    type =&gt; "logs"
    ssl_certificate =&gt; "/etc/pki/tls/certs/logstash-forwarder.crt"
    ssl_key =&gt; "/etc/pki/tls/private/logstash-forwarder.key"
     }
     }
  
         filter {
   if [type] == "scan_production" {
  
   if "LISTING_SCRAPER SUCCESS" in [message]{
      grok{
    match =&gt; { "message" =&gt; "(?&lt;severity&gt;[E]|[W]|%{GREEDYDATA})\, +\[(?   &lt;timestamp&gt;%{TIMESTAMP_ISO8601}) \#(?&lt;id&gt;%{INT})\] +%{WORD:message_type} \-\- \: (?&lt;command&gt;%{DATA}\:|%{DATA}\:%{NOTSPACE}) %{NOTSPACE:site_name} \location: (?&lt;location_id&gt;%{INT}|%{SPACE}) time\:\ %{BASE10NUM:site_access_time:float}" }
    add_field =&gt; [ "received_at", "%{@timestamp}" ]
    add_field =&gt; [ "received_from", "%{host}" ]
    }
   mutate {
    convert =&gt; ["site_access_time", "float"]
    }
  }
  
    else if "LISTING_CRAWLER SUCCESS site" in [message]{
      grok{
    match =&gt; { "message" =&gt; "(?&lt;severity&gt;[E]|[W]|%{GREEDYDATA})\, +\[(?&lt;timestamp&gt;%{TIMESTAMP_ISO8601}) \#(?&lt;id&gt;%{INT})\] +%{WORD:message_type} \-\- \: (?&lt;command&gt;%{DATA}\:|%{DATA}\:%{NOTSPACE}) %{NOTSPACE:site_name} \location: (?&lt;location_id&gt;%{INT}|%{SPACE}) time\:\ %{BASE10NUM:site_access_time:float} items\: %{BASE10NUM:location_iteam:float}" }
    add_field =&gt; [ "received_at", "%{@timestamp}" ]
    add_field =&gt; [ "received_from", "%{host}" ]
    }
   mutate {
     convert =&gt; ["site_access_time", "float"]
   }
   }
  else{
   grok {
  match =&gt; { "message" =&gt; "(?&lt;severity&gt;[E]|[W]|%{GREEDYDATA})\, +\[(? &lt;timestamp&gt;%{TIMESTAMP_ISO8601}) \#(?&lt;id&gt;%{INT})\] +%{WORD:message_type} \-\- \: (?&lt;command&gt;%{DATA}\:|%{DATA}\:%{NOTSPACE}) %{GREEDYDATA:result}" }
    add_field =&gt; [ "received_at", "%{@timestamp}" ]
    add_field =&gt; [ "received_from", "%{host}" ]
           }
         }
       }
     }
  
  
  output {
   elasticsearch { host =&gt; localhost
      protocol =&gt; http
  }
  stdout { codec =&gt; rubydebug }
   }
  </code></pre>