In Graylog it is possible to configure a GELF TCP Input using TLS, but currently the logstash-output-gelf plugin doesn't support sending events over secured TCP. Sounds like something important to add to a future version.