Graylog3 (3.0.2) as datasource for streams (?) and firewall logs


we have the lates Grafana version and Graylog 3.0.2. My goal was to add a (ELK) datasource for creating graphs from our Fortigate logs and blocks. What ever I try, it fails and I get a 404. Our Graylog ULR is (no port) and we have authentication enabled. Also I tried to play with the index (graylog_* / graylog_0 … etc) … but no success. I have only a 404.
If I test the source:

192.168.x.x - - [06/Jan/2020:09:50:34 +0100] "GET /graylog_%2A/_mapping HTTP/1.1" 200 455 "-"  Grafana/6.5.2"

The "%2A comes from the Index grafana_*.

Our graylog is behind a Apache2 reverse proxy which forwards everything to the internal Graylog host and port.
If I try to use the ELK datasource:

192.168.x.x - - [06/Jan/2020:09:53:14 +0100] "POST /_msearch HTTP/1.1" 404 50 "-" "Grafana/6.5.2"

which results in a 404.

Question is: How can I get the streams / logs into my Grafana Dashboard

Any suggestions ?