A good way to troubleshoot error messages is to use the dashboards in the humio/activity package to create overviews to identify patterns. Some possibilities for dashboards are to show the cost over time of alerts or scheduled searches, show the top alert messages over time, or show scheduled search performance lags, for example. The humio/activity package contains useful dashboards to gather this information.