...
cluster.name: graylog
action.auto_create_index: false
Also edit /etc/graylog/server/server.conf and point to the elasticsearch ip instead of the localhost ip, then restart graylog
root@graylog2:/etc/graylog/server# grep "192.168.1.12:9200" server.conf
elasticsearch_hosts = http://192.168.1.12:9200