[heartbeat] tls cert event data proposal

[Crazybus]

In #3406 (comment) there was a suggestion for adding extra metadata including:

"tls": {
  "rtt": { "handshake": ... },
  "status": {
    "version": "TLS 3.0",
    "cipher": ...
  }
  "cert": {
    "expires": ...,
    ... // more certificate meta data?
  }
}

Specifically I am mostly interested in sending the tls.cert.expires key so that we can easily alert on certificates that will be expiring soon instead of the monitor failing once it has already expired.

Proposal

Ideally I would like to implement the following extra fields

1. tls.cert.expires.notAfter: 2016-01-03T00:00:00.000Z
2. tls.cert.expires.notBefore: 2019-02-06T00:00:00.000Z
3. tls.status.version: TLS 3.0
4. tls.status.cipher: ECDHE-RSA-AES256-GCM-SHA384

There are a lot of other fields that could be added however I see these being the most interesting when being combined with alerting.

[andrewkroh]

We should try use the same field names as Packetbeat TLS for this. See

• https://www.elastic.co/guide/en/beats/packetbeat/current/configuration-tls.html
• https://github.com/elastic/beats/blob/master/packetbeat/protos/tls/_meta/fields.yml