I still have very little to go on. The way you are describing it, you have stopped and deleted all inputs and there is still information coming into Graylog?
You can find more on how to ask questions with helpful information here and here. It includes things like posting code with the </> forum tool to make code/logs more readable and how to pull config files without including all the comments (Commented lines starting with #) Also making sure you are obfuscating any private information…
We know nothing about your setup so any relevant information you can provide including steps you have tried are very helpful for figuring out how to solve the incident!