I've removed the report section, and the email sends without a problem. So there is something about this portion:
"attachments": { "error.pdf": { "reporting": { "url": "https://vccn7:5601/api/reporting/jobs/download/jj0j4zsp0zw290eb70b9g26e", "retries": 5, "interval": "15s" } } },
There are a few certs in play here. The first is for node to node elasticsearch communication, and it is all self-signed. Next is our private CA signed cert for https connections via nginx or kibana. The last is for the public https URL metrics.xyz.com and it is signed by a public CA (this terminates on a load balancer).
I've replaced the URL inside the watcher with all 3 possiblities for the URL:
kibana: https://vccn7:5601/api/reporting/jobs/download/jj0j4zsp0zw290eb70b9g26e
nginx: https://vccn7/api/reporting/jobs/download/jj0j4zsp0zw290eb70b9g26e
LB: https://metrics.xyz.com/api/reporting/jobs/download/jj0j4zsp0zw290eb70b9g26e
However it's still not working.