TLS encryption layer fields

None

TLS layer related fields.

tls.certificate_not_valid_before

[7.8.0]

Deprecated in favor of tls.server.x509.not_before. Earliest time at which the connection’s certificates are valid.

type: date

tls.certificate_not_valid_after

[7.8.0]

Deprecated in favor of tls.server.x509.not_after. Latest time at which the connection’s certificates are valid.

type: date

TLS layer round trip times.

Time required to finish TLS handshake based on already available network connection.

tls.rtt.handshake.us

Duration in microseconds

type: long

Detailed x509 certificate metadata

tls.server.version_number

Version of x509 format.

type: keyword

example: 3