First thing I can think of: Graylog’s index names are not static, right? They get rotated frequently, so your connection would break anyway. “Graylog_0” will be phased out in a few days/weeks, and Graylog will continue with “graylog_1”.
[root@elasticsearch elasticsearch]# curl 'localhost:9200/_cat/indices?v'
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size
green open graylog_0 9BFGyliASZGiGGKkA9NFBA 4 0 1611223 0 1.2gb 1.2gb
Depending on what you’re trying to get displayed on your Grafana dashboard, you may find that the prometheus metrics plugin is suitable for your needs.
Install the prometheus plugin onto your Graylog server, setup prometheus somewhere (on the same host as Grafana perhaps?) and then add prometheus as a data source in Grafana.
Graylog name the timestamp not @timestamp but timestamp and watch out what @Totally_Not_A_Robot already wrote. Depending on your configuration Graylog will rotate the indices so you need to configure that pattern…