i’m attempting to make the tls logging endpoint compatible with splunk’s HEC, which requires some fields at the base level of json (host, time, etc)