diff --git a/stable/graylog/Chart.yaml b/stable/graylog/Chart.yaml
index 4ff4bca83e..d569c0161f 100755
--- a/stable/graylog/Chart.yaml
+++ b/stable/graylog/Chart.yaml
@@ -1,7 +1,7 @@
 apiVersion: v1
 name: graylog
 home: https://www.graylog.org
-version: 1.5.7
+version: 1.5.8
 appVersion: 3.1
 description: Graylog is the centralized log management solution built to open standards for capturing, storing, and enabling real-time analysis of terabytes of machine data.
 keywords:
diff --git a/stable/graylog/README.md b/stable/graylog/README.md
index 660ab69582..64f9f7fc55 100644
--- a/stable/graylog/README.md
+++ b/stable/graylog/README.md
@@ -142,7 +142,11 @@ The following table lists the configurable parameters of the Graylog chart and t
 | `graylog.existingRootSecret`            | Graylog existing root secret                                                                                                                          | ``                                    |
 | `graylog.rootTimezone`                  | Graylog root timezone.                                                                                                                                | `UTC`                                 |
 | `graylog.elasticsearch.hosts`           | Graylog Elasticsearch host name. You need to specific where data will be stored.                                                                      | ``                                    |
+| `graylog.elasticsearch.uriSecretName`   | K8s secret name where elasticsearch hosts will be set from.                                                                                           | `{{ graylog.fullname }}`              |
+| `graylog.elasticsearch.uriSecretKey`    | K8s secret key name where elasticsearch hosts will be set from.                                                                                       | ``                                    |
 | `graylog.mongodb.uri`                   | Graylog MongoDB connection string. You need to specific where data will be stored.                                                                    | ``                                    |
+| `graylog.mongodb.uriSecretName`         | K8s secret name where MongoDB URI will be set from.                                                                                                   | `{{ graylog.fullname }}`              |
+| `graylog.mongodb.uriSecretKey`          | K8s secret key name where MongoDB URI will be set from.                                                                                               | ``                                    |
 | `graylog.transportEmail.enabled`        | If true, enable transport email settings on Graylog                                                                                                   | `false`                               |
 | `graylog.config`                        | Add additional server configuration to `graylog.conf` file.                                                                                           | ``                                    |
 | `graylog.serverFiles`                   | Add additional server files on /etc/graylog/server. This is useful for enable TLS on input                                                            | `{}`                                  |
diff --git a/stable/graylog/templates/_helpers.tpl b/stable/graylog/templates/_helpers.tpl
index 6a7c9a32b4..fbcf710164 100644
--- a/stable/graylog/templates/_helpers.tpl
+++ b/stable/graylog/templates/_helpers.tpl
@@ -77,7 +77,9 @@ Create a default fully qualified elasticsearch name or use the `graylog.elastics
 Or use chart dependencies with release name
 */}}
 {{- define "graylog.elasticsearch.hosts" -}}
-{{- if .Values.graylog.elasticsearch.hosts }}
+{{- if .Values.graylog.elasticsearch.uriSecretKey }}
+    {{- printf "${GRAYLOG_ELASTICSEARCH_HOST}" -}}
+{{- else if .Values.graylog.elasticsearch.hosts }}
     {{- .Values.graylog.elasticsearch.hosts -}}
 {{- else }}
     {{- printf "http://%s-elasticsearch-client.%s.svc.cluster.local:9200" .Release.Name .Release.Namespace -}}
@@ -89,7 +91,9 @@ Create a default fully qualified mongodb name or use the `graylog.mongodb.uri` v
 Or use chart dependencies with release name
 */}}
 {{- define "graylog.mongodb.uri" -}}
-{{- if .Values.graylog.mongodb.uri }}
+{{- if .Values.graylog.mongodb.uriSecretKey }}
+    {{- printf "${GRAYLOG_MONGODB_URI}" -}}
+{{- else if .Values.graylog.mongodb.uri }}
     {{- .Values.graylog.mongodb.uri -}}
 {{- else }}
     {{- printf "mongodb://%s-mongodb-replicaset.%s.svc.cluster.local:27017/graylog?replicaSet=rs0" .Release.Name .Release.Namespace -}}
diff --git a/stable/graylog/templates/configmap.yaml b/stable/graylog/templates/configmap.yaml
index 2630b6b137..838777d5b1 100644
--- a/stable/graylog/templates/configmap.yaml
+++ b/stable/graylog/templates/configmap.yaml
@@ -186,6 +186,10 @@ data:
     echo "Starting graylog"
     # Original docker-entrypoint.sh in Graylog Docker will error while executing since you can't chown readonly files in `config`
     # exec /docker-entrypoint.sh graylog
+  {{- if or (.Values.graylog.elasticsearch.uriSecretKey) (.Values.graylog.mongodb.uriSecretKey) }}
+    # Interpolate
+    sed 's/"/\\\"/g;s/.*/echo "&"/e' ${GRAYLOG_HOME}/config/graylog.conf > ${GRAYLOG_HOME}/graylog.conf.subst
+  {{- end }}
     echo "Graylog Home ${GRAYLOG_HOME}"
     echo "JVM Options ${GRAYLOG_SERVER_JAVA_OPTS}"
     "${JAVA_HOME}/bin/java" \
@@ -196,4 +200,8 @@ data:
       -Dgraylog2.installation_source=docker \
       ${GRAYLOG_HOME}/graylog.jar \
       server \
+    {{- if or (.Values.graylog.elasticsearch.uriSecretKey) (.Values.graylog.mongodb.uriSecretKey) }}
+      -f ${GRAYLOG_HOME}/graylog.conf.subst
+    {{- else }}
       -f ${GRAYLOG_HOME}/config/graylog.conf
+    {{- end }}
diff --git a/stable/graylog/templates/statefulset.yaml b/stable/graylog/templates/statefulset.yaml
index c9f7b69724..8806b6f6bf 100644
--- a/stable/graylog/templates/statefulset.yaml
+++ b/stable/graylog/templates/statefulset.yaml
@@ -102,6 +102,20 @@ spec:
                 secretKeyRef:
                   name: {{ .Values.graylog.existingRootSecret | default (include "graylog.fullname" .) }}
                   key: graylog-password-sha2
+            {{- if .Values.graylog.elasticsearch.uriSecretKey }}
+            - name: GRAYLOG_ELASTICSEARCH_HOST
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.graylog.elasticsearch.uriSecretName | default (include "graylog.fullname" .) }}
+                  key: {{ .Values.graylog.elasticsearch.uriSecretKey }}
+            {{- end }}
+            {{- if .Values.graylog.mongodb.uriSecretKey }}
+            - name: GRAYLOG_MONGODB_URI
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.graylog.mongodb.uriSecretName | default (include "graylog.fullname" .) }}
+                  key: {{ .Values.graylog.mongodb.uriSecretKey }}
+            {{- end }}
             {{- range $key, $value := .Values.graylog.env }}
             - name: {{ $key }}
               value: {{ $value | quote }}
diff --git a/stable/graylog/values.yaml b/stable/graylog/values.yaml
index f7763351b0..b80e031774 100644
--- a/stable/graylog/values.yaml
+++ b/stable/graylog/values.yaml
@@ -270,12 +270,20 @@ graylog:
     ##
     # hosts: http://elasticsearch-client.graylog.svc.cluster.local:9200
     hosts: ""
+    # Allow elasticsearch hosts to be fetched from a k8s secret
+    # {{ graylog.fullname }} will be used as uriSecretName if left empty
+    uriSecretName: ""
+    uriSecretKey: ""
 
   mongodb:
     ## MongoDB connection string
     ## See https://docs.mongodb.com/manual/reference/connection-string/ for details
     # uri: mongodb://user:pass@host1:27017,host2:27017,host3:27017/graylog?replicaSet=rs01
     uri: ""
+    # Allow mongodb uri to be fetched from a k8s secret
+    # {{ graylog.fullname }} will be used as uriSecretName if left empty
+    uriSecretName: ""
+    uriSecretKey: ""
 
     ## Increase this value according to the maximum connections your MongoDB server can handle from a single client
     ## if you encounter MongoDB connection problems.