Apparently, the answer to this already existed in another thread. Log SNI in TCP mode
The ordering matters, capture has to come before accept. This works for me.
tcp-request inspect-delay 3s
tcp-request content capture req.ssl_sni len 100
log-format "%[capture.req.hdr(0)]"