[New Rule] Large data exfiltration from elasticsearch clusters

### Description

While dumping data from our production cluster to a local cluster for troubleshooting purpose, I realised that it might be interesting to have a detection for large unusual data export from elasticsearch.

I'm not sure what rule type it could be (threshold, ESQL, ML, ...). It could be one or many rules.

It could be interesting to reference this rule when elasticsearch is hitting the news for massive data leakage (due to poorly configured elasticsearch).

### Target Ruleset

other

### Target Rule Type

None

### Tested ECS Version

_No response_

### Query

_No response_

### New fields required in ECS/data sources for this rule?

Probably not

### Related issues or PRs

_No response_

### References

https://cybernews.com/security/risika-swedish-data-exposed/

### Redacted Example Data

_No response_