# Watcher Email CSV Issue

**URL:** <https://discuss.elastic.co/t/watcher-email-csv-issue/370174>\
**Category:** Kibana\
**Created:** [November 7, 2024, 4:01pm UTC](https://discuss.elastic.co/t/watcher-email-csv-issue/370174 "2024-11-07T16:01:02Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![erikg](https://avatars.discourse-cdn.com/v4/letter/e/91b2a8/32.png) [@erikg](https://discuss.elastic.co/u/erikg)\
**Post date:** [November 7, 2024, 4:01pm UTC](https://discuss.elastic.co/t/watcher-email-csv-issue/370174/1 "2024-11-07T16:01:02Z")

</div>

Hello,

I am on ES/Kibana 8.15.3  
I attempted to create a watcher using the POST URL for saved searches.

The issue is that its not working, its saying its an SSL Handshake exception:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/b/1b1621626231ff64786ca72f8662ddabe827bb03.png)

This is very confusing because Kibana and Elasticsearch are communicating via SSL with no issues. This might be a bug when we upgraded?

---

<div class="post-metadata">

**Author:** ![bhavyarm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bhavyarm/32/22392_2.png) [@bhavyarm](https://discuss.elastic.co/u/bhavyarm)\
**Post date:** [November 12, 2024, 7:25pm UTC](https://discuss.elastic.co/t/watcher-email-csv-issue/370174/2 "2024-11-12T19:25:14Z")

</div>

@alisongoryachev can we get some inputs on this please? Thanks!

---

<div class="post-metadata">

**Author:** ![alisongoryachev](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alisongoryachev/32/111352_2.png) [@alisongoryachev](https://discuss.elastic.co/u/alisongoryachev)\
**Post date:** [November 12, 2024, 7:50pm UTC](https://discuss.elastic.co/t/watcher-email-csv-issue/370174/3 "2024-11-12T19:50:44Z")

</div>

Hi @erikg can you clarify if you are using the watcher UI in Kibana to create this watch or the ES watcher API directly?

---

<div class="post-metadata">

**Author:** ![erikg](https://avatars.discourse-cdn.com/v4/letter/e/91b2a8/32.png) [@erikg](https://discuss.elastic.co/u/erikg)\
**Post date:** [November 12, 2024, 8:00pm UTC](https://discuss.elastic.co/t/watcher-email-csv-issue/370174/4 "2024-11-12T20:00:52Z")

</div>

Hey @alisongoryachev  
Using the Watcher UI, it's strange, we tested this before and it worked fine (8.14.3). I think some new setting was changed.

---

<div class="post-metadata">

**Author:** ![mattkime](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mattkime/32/43522_2.png) [@mattkime](https://discuss.elastic.co/u/mattkime)\
**Post date:** [November 13, 2024, 4:47pm UTC](https://discuss.elastic.co/t/watcher-email-csv-issue/370174/5 "2024-11-13T16:47:15Z")

</div>

The screenshot you posted - is that captured from the browser dev console or is it from the logs? It would be helpful if we could see the request the browser is sending, best captured with a har file,.