As in Tim's final request for clarification:
a/ have you tried recreating the issue outside of Canvas?
b/ Do you notice any elasticsearch queries failing intermittently elsewhere?
Especially b/. Anything in application monitoring, APM-type monitoring, anything that allows you to detect other intermittent query failures except in your canvas viz? Or is the viz the only thing you're using this cluster for?