A raw message is the unparsed data Graylog2 was handed by an input.
Typically this is a copy of the exact bytes received over the network, after all de-chunking, removal of transport headers, etc has been performed, but before any parsing, decoding, checking of the actual payload has been performed.
Each raw message has a unique id, a timestamp it was received at (this might be different from the timestamp contained in the payload, if that has any), a tag of what payload type this is supposed to be (e.g. syslog, GELF, RadioMessage etc.), as well as an opaque meta data structure.
The format of the meta data is not stable yet, but will likely be a JSON string.