Is Graylog effectively a single product that does the whole thing?
My dismay with the ELK stack is you are effectively juggling 3 separate products with different release cycles.
The graylog-web-interface connects to the graylog-server REST APIs and that is it. You can manage and monitor the whole system from the graylog-web-interface.
Both components are always released together.