es_index_to_file.sh

#!/bin/bash

es_url="localhost:9200"
index="logstash-123"

response=$(curl -s -H 'Content-Type: application/json' "$es_url/$index/_search?scroll=5m&size=10000")
scroll_id=$(jq -r '._scroll_id' <<<"$response")
hits_count=$(jq -r '.hits.hits | length' <<<"$response")
hits_so_far=hits_count
echo "Got initial response with $hits_count hits and scroll ID $scroll_id"

while [ "$hits_count" != "0" ]; do
    response=$(curl -s -H 'Content-Type: application/json' $es_url/_search/scroll -d "{ \"scroll\": \"1m\", \"scroll_id\": \"$scroll_id\" }")
    scroll_id=$(jq -r '._scroll_id' <<<"$response")
    hits_count=$(jq -r '.hits.hits | length' <<<"$response")
    hits_so_far=$((hits_so_far + hits_count))
    echo "Got response with $hits_count hits (hits so far: $hits_so_far), new scroll ID $scroll_id"
    if [[ "$scroll_id" == "null" ]]; then
        echo "$response"
    fi
    jq -c -r '.hits.hits[]._source' >>"./$index.json" <<<"$response"
done

echo Done!