Graylog 2.x does not work with Elasticsearch 5.x!
As clearly noted here:
Is this on the radar to be a supported configuration?
2017-02-19T12:21:26.738Z WARN [IndexerSetupService] Could not connect to Elasticsearch 2017-02-19T12:21:26.738Z INFO [IndexerSetupService] If you're using multicast, check that it is working in your network and that Elasticsearch is accessible. Also check that the cluster name setting is correct. 2017-02-19T12:21:26.739Z INFO [IndexerSetupService] See http://docs.graylog.org/en/2.2/pages/configuration/elasticsearch.html for details. 2017-02-19T12:27:18.077Z INFO [IndexerClusterCheckerThread] Indexer not fully initialized yet. Skipping periodic cluster check. 2017-02-19T12:27:18.795Z WARN [V20161130141500_DefaultStreamRecalcIndexRanges] Interrupted or timed out waiting for Elasticsearch cluster, checking again. 2017-02-19T12:27:48.081Z INFO [IndexerClusterCheckerThread] Indexer not fully initialized yet. Skipping periodic cluster check.