Log2timeline timeline generation: Output and formatting

# Output and formatting

The plaso tools `psort.py` and `psteal.py` can output events in multiple
formats using several output modules.

## Output modules

Plaso supports several output formats:

Name | Description
--- | ---
dynamic | Output events to a delimiter (comma by default) separated value output format, that supports a dynamic selection of fields.
json | Output events to JSON format.
json_line | Output events to JSON line format.
kml | Output events with geography data into a KML format.
l2tcsv | Output events to log2timeline.pl legacy CSV format, with 17 fixed fields. Also see: [l2tcsv output format](Output-format-l2tcsv.html)
l2ttln | Output events to log2timeline.pl extended TLN format, with 7 fixed field. | delimited output. Also see: [TLN](https://forensics.wiki/tln).
null | Do not output events.
rawpy | Output events in "raw" (or native) Python format.
opensearch | Saves the events into an OpenSearch database. Requires opensearchpy.
opensearch_ts | Saves the events into an OpenSearch database for use with Timesketch. Requires opensearchpy
tln | Output events to TLN format, with 5 fixed fields. Also see: [TLN](https://forensics.wiki/tln).
xlsx | Output events to an Excel Spreadsheet (XLSX).

The following sections define "special" fields that are composed at runtime.

### Common runtime fields

Output fields that are not part of the event data but of the data stream the
event data originates from.

Name | Description
--- | ---
file_entropy | Byte entropy of the data stream content. This is a value ranging from 0.0 to 8.0, where 8.0 indicates the distribution of byte values is highly random.
md5_hash | MD5 hash of the data stream content.
sha1_hash | SHA-1 hash of the data stream content.
sha256_hash | SHA-256 hash of the data stream content.
yara_match | Names of the Yara rules that matched the data stream content.

### Dynamic runtime fields

The dynamic output module defines the following command line options to specify
which fields should be represented in the output, namely `--fields` and
`--additional_fields`. The name of the fields typically map 1-to-1 to the names
of attributes of the event data.

Name | Description
--- | ---
date | The date of the event formatted as "YYYY-MM-DD" or "0000-00-00" on error
datetime | The date and time of the event in ISO 8601 format in microseconds or "0000-00-00T00:00:00.000000+00:00" on error
description | The event message string as defined by the message formatter
description_short | The short event message string as defined by the message formatter
display_name | Human readable representation of the path specification
filename | The "filename" attribute if present in the event data, otherwise derived from the path specification
host | The hostname derived by pre-processing
hostname | The hostname derived by pre-processing
inode | The "inode" attribute if present in the event data, otherwise derived from the file system identifier (such as inode, MFT entry) in the path specification
macb | MACB (Modification, Access, Change, Birth) group representation
message | The event message string as defined by the message formatter
message_short | The short event message string as defined by the message formatter
source | The short event source as defined by `data/sources.config`
sourcetype | The event source as defined by `data/sources.config`, equivalent to source_long
source_long | The event source as defined by `data/sources.config`
tag | The labels defined by event tags
time | The time of the event in seconds formatted as "HH:MM:SS" or "--:--:--" on error
timestamp_desc | Indication of what the event time represents such as Creation Time or Program Execution Duration
timezone | Time zone indicator
type | Indication of what the event time represents such as Creation Time or Program Execution Duration, equivalent to timestamp_desc
user | The username derived by pre-processing, equivalent to username
username | The username derived by pre-processing
zone | Time zone indicator, equivalent to timezone

Note that the `--dynamic-time` output option will change the format of the
datetime output field to use value appropriate granularity, for example seconds
for a HFS+ timestamp will be "YYYY-MM-DDTHH:MM:SS" but for an NTFS FILETIME it
will be "YYYY-MM-DDTHH:MM:SS.#######", or a semantic time, for example
"Not set", or "Error" on error. Older Plaso storage files do not necessarily
support the dynamic time option.

### JSON output module fields

Name | Description
--- | ---
display_name | Human readable representation of the path specification
filename | The "filename" attribute if present in the event data, otherwise derived from the path specification
inode | The "inode" attribute if present in the event data, otherwise derived from the file system identifier (such as inode, MFT entry) in the path specification
message | The event message string as defined by the message formatter
pathspec | JSON serialized path specification
parser | Chain of parsers that generated the event.
tag | The labels defined by event tags
timestamp_desc | Indication of what the event time represents such as Creation Time or Program Execution Duration

### Native (or "raw") Python runtime fields

Name | Description
--- | ---
display_name | Human readable representation of the path specification
filename | The "filename" attribute if present in the event data, otherwise derived from the path specification
inode | The "inode" attribute if present in the event data, otherwise derived from the file system identifier (such as inode, MFT entry) in the path specification
message | The event message string as defined by the message formatter
parser | Chain of parsers that generated the event.
short_source | The short event source as defined by `data/sources.config`
source_long | The event source as defined by `data/sources.config`
timestamp_desc | Indication of what the event time represents such as Creation Time or Program Execution Duration

### OpenSearch runtime fields

Name | Description
--- | ---
display_name | Human readable representation of the path specification
message | The event message string as defined by the message formatter
parser | Chain of parsers that generated the event.
short_source | The short event source as defined by `data/sources.config`
source_long | The event source as defined by `data/sources.config`
tag | The labels defined by event tags
timestamp_desc | Indication of what the event time represents such as Creation Time or Program Execution Duration

## Output field formatting

### Source fields

As of Plaso 20200916 the value of the long and short source fields are defined
in `data/sources.config`. This file contains 3 tab separated values:

* data_type; event data type.
* short_source; short source identifier that corresponds with the l2tcsv and tln source field.
* source; source identifier that corresponds with the l2tcsv sourcetype field.

## Message formatting

In log2timeline.pl the l2tcsv format introduced the `desc` a