Messages of internal errors must not be displayed to end-users

See the attached screenshot, when a failure happens when executing an ES request, a big error message containing the ES request is displayed to the user.

First this error message is cryptic for end-users but more importantly this might lead to a big security vulnerability.

No error messages of internal errors (500 HTTP code) must be displayed. They must only be logged with level ERROR.