Cool… so for input redundancy, you technically only need a Graylog cluster. ES can still be a single node. I do not recommend this, but it would work.
This would work mainly because if you need to upgrade ES (which is a single node) the messages will queue up on Graylog until the upgrade is complete. So in essence, you don’t lose a message, but you can not search for anything either. If this is an ok scenario, then just build the Graylog cluster with a MongoDB replica set, and point it at the ES node on the back end. Optionally put a load balancer in front of the Graylog cluster.
Obviously, any single node is not redundant if something were to happen to the hardware or system that it is running on, so if full true redundancy is something you want, you’ll need to make both redundant by clustering them.
So better solution (and more forward thinking) in your case (based on my understanding) is to setup a 3 node Graylog cluster, leveraging a MongoDB replica set, a 3 node Elasticsearch cluster, and then perhaps put a load balancer in front of the Graylog cluster.
Also, you can have the same 3 hosts simultaneously be part of both the Graylog/MongoDB cluster and the ES Cluster, but unless you are tight on resources… I’m not a fan of this design.