Based off what we know here:

When the insource query is not sufficiently optimized SourceRegexQuery will simply stop collecting results when max_inspect is reached.
This is confusing for the user as the result pages will contain partial results without any warnings.
We should use the builtin timeout feature from elastic and display a warning to the user when we failed to scan the index entirely. The user could then try to optimize its regex.

We should figure out how to display the actual error message to the end user so that they can 'fix' their query to get the results that they were looking for.