I would go with one of this two options, the one you feel more confortable with:
Just with Logstash: elasticsearch-input using scroll option and output-file
The other option is to use a client library like Python. It provides you an iterator over your query, so it is very memory efficient: doc-here
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.