Results in the following error:
"reason"=>"compile error", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"invalid sequence of tokens near ['%'].", "caused_by"=>{"type"=>"no_viable_alt_exception"
Are you 100% sure all events have a [shodan][protocols] field? You'll have to double-quote the variable expansion, i.e. do this:
script => 'ctx._source.shodan.protocols += "%{[shodan][protocols]}"'
Which version of Logstash are you using?
script => "%{[ctx][_source][shodan][protocols]} += %{[shodan][protocols]}"
That's just wrong.