Check the logs of your Elasticsearch nodes. http://docs.graylog.org/en/2.4/pages/configuration/file_location.html