Check the logs of your Graylog node(s). http://docs.graylog.org/en/2.4/pages/configuration/file_location.html