I think it has something to do with graylog “talking” with elasticsearch. When I configured graylog1 as a stand alone it worked but now with 3 nodes it fails.
I implemented this on the singe node to get it to work 
Graylog not able to connect to Elasticsearch cluster