TLS encryption layer fields

edit

TLS encryption layer fieldsedit

None

tlsedit

TLS layer related fields.

tls.certificate_not_valid_before

[7.8.0] Deprecated in 7.8.0.

Deprecated in favor of tls.server.x509.not_before. Earliest time at which the connection’s certificates are valid.

type: date

tls.certificate_not_valid_after

[7.8.0] Deprecated in 7.8.0.

Deprecated in favor of tls.server.x509.not_after. Latest time at which the connection’s certificates are valid.

type: date

rttedit

TLS layer round trip times.

handshakeedit

Time required to finish TLS handshake based on already available network connection.

tls.rtt.handshake.us

Duration in microseconds

type: long

serveredit

Detailed x509 certificate metadata

tls.server.version_number

Version of x509 format.

type: keyword

example: 3