Hi @Thibaut_M,
Yes, it's a breaking change in ES mentioned here. Can't you just prepend you script with another if
?
if (doc['action.keyword'].size() == 0) return '';
if ((doc['action.keyword'].value == 'Deny') || (doc['action.keyword'].value == 'denied') || (doc['action.keyword'].value == 'denied by ACL') || (doc['action.keyword'].value == 'Denied')) { return 'Deny'; } return '';
Best,
Oleg