you would need to debug the chain - I would start in Graylog.
If Elasticsearch is running and messages are ingested from Graylog to Elasticsearch, try
System > indices > index-name > maintenance > recalculate index range
So the point is - mesages are ingested into Graylog and after processing to Elasticsearch? Did you see stats in the UI in the right up (in means ingest to Graylog and out means push to Elasticsearch) that should be the same number.