The logstash input plugin for beats supports the ssl_peer_metadata option, which allows logstash to extract the DN fields of client certificates:
https://www.elastic.co/guide/en/logstash/current/plugins-inputs-beats.html#plugins-inputs-beats-ssl_peer_metadata
This is a very important feature which also allows to whitelist certain clients.
The logstash input plugin for tcp however does not offer that option. Please implement it.