How to configure the elastic search endpoint so that graylog-ctl reconfigure does not overwrite it

Overriding the elasticsearch_hosts configuration setting is currently not possible when using the Graylog omnibus package (which is being used in the OVAs and AMIs).

If you feel this is a crucial feature, please file an issue at Pull requests · Graylog2/omnibus-graylog2 · GitHub

This being said, the omnibus package (AMI, OVA) is supposed to be a turnkey solution and was not designed for maximum customization. I’d recommend starting with your own Graylog setup instead of using the pre-baked AMI if you want to use the AWS Elasticsearch Service.