TLS encryption layer fields

None

tls

TLS layer related fields.

tls.certificate_not_valid_before

[7.8.0] Deprecated in 7.8.0.

Deprecated in favor of tls.server.x509.not_before. Earliest time at which the connection’s certificates are valid.

type: date

tls.certificate_not_valid_after

[7.8.0] Deprecated in 7.8.0.

Deprecated in favor of tls.server.x509.not_after. Latest time at which the connection’s certificates are valid.

type: date

rtt

TLS layer round trip times.

handshake

Time required to finish TLS handshake based on already available network connection.

tls.rtt.handshake.us

Duration in microseconds

type: long

server

Detailed x509 certificate metadata

tls.server.version_number

Version of x509 format.

type: keyword

example: 3