Search Guard versions prior to 24.0 had an issue that values of string arrays in documents are not properly anonymized.
search-guard search guard