I have next one task: I want to collect (with collect command) information which I got after stats. Problem is that there is empty _raw field, and I don't want to add _raw in stats (because of heavy search)
usually _raw isn't a field stored with collect command.
But if you have, in the collect fields, information do exactly define the _raw event (or events), you could create (in dashboard) a drilldows feature to display (from the index) only the _raw events interested to a selected raw in stats.
this is the approach used in ES where you have Correlation Searches that contain only the data relevant for the alert, then for each of them you can define a drilldown search that takes raw data from the index related to an alert using the information in the Correlation Search.