How did you end up in this situation? Why can the node not rejoin the cluster?
The FS got corrupted so we spent a few days recovering it... A lot of stuff happened, but long story short - if he joins the cluster he will delete the indices because they are no longer present on the current cluster (they were deleted).
I suspect you will need to use the elasticsearch-node tool, but note that this comes with warnings and is unsafe. I will not be able to help with this as I have fortunately not had to use it, but maybe someone else can help if you have issues or questions around the docs.
We did a lot of testing on a massive cluster we have and Logstash is only good for a small amount of data. Same goes for a remote reindex (since slicing is not supported).
No matter how much we tuned a single logstash couldn't go over 60k/s ingesting and a remote reindex capped at about 30-35k/s.
Another bad thing with Logstash is it has no state when using elasticsearch as input and output. If it restarts or crashes or smth and you have to restart it, it will re-read all the indexes (assuming you give it a wildcard). If going index by index you have to monitor it constantly which is also not ideal.
Best bet in case of smaller data, imo is remote reindex as it can be monitored via task API.
In big clusters, snapshot/restore is by FAR the best bet.