Search Guard versions prior to 23.1 had an issue that for aggregations clear text values of anonymised fields were leaked.
search-guard search guard