Just a thought, shouldn’t http_external_uri be httpd://a.b.c.d/ ?
http_bind_address 127.0.0.1:9000
The network interface used by the Graylog HTTP interface.
http_publish_uri If not set, http://$http_bind_address will be used.
The HTTP URI of this Graylog node which is used to communicate with the other Graylog nodes in the cluster and by all clients using the Graylog web interface.
http_external_uri If not set, $http_publish_uri will be used.
The public URI of Graylog which will be used by the Graylog web interface to communicate with the Graylog REST API. Graylog web interface.