you have two problems:
-
Deflector problem: https://community.graylog.org/t/how-to-fix-deflector-exists-as-an-index-and-is-not-an-alias-warning/2826
-
Yellow cluster: do you have number of replicas 1 for the graylog index set (System/Indices menu), but only one ES server. The number of replicas must be at most the number of ES servers minus one ( 1 replica means that you need 2 servers: one for the original, the other for the replica).