lnav format for evtx timelines, created with ` evtx2bodyfile`, `mactime2` and ` jq`

evtx_timeline.json

{
    "$schema": "https://lnav.org/schemas/format-v1.schema.json",
    "evtx_timeline": {
        "title": "Windows EVTX timeline",
        "file-pattern": "evtx.*\\.json(\\.gz)?",
        "json": true,
        "line-format": [
            {"field": "ts"},
            "|",
            {"field": "event_id", "min-width": 5, "max-width": 5, "align": "right"},
            "|",
            {"field": "channel", "max-width": 32, "overflow": "dot-dot"},
            "|" ,
            {"field": "data", "overflow": "truncate"}
        ],
        "timestamp-field": "ts",
        "timestamp-format": ["%FT%T%z"],
        "value": {
            "channel": {
                "kind": "string"
            },
            "event_id": {
                "kind": "integer"
            },
            "data": {
                "kind": "json"
            }
        },
        "body-field": "event",
        "opid-field": "event_id",
        "module-field": "channel",
        "multiline": false,
        "hide-extra": false,
        "ordered-by-time": true,
        "convert-to-local-time": false,

        "highlights": {
            "ipv4": {
                "pattern": "(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)",
                "color": "yellow"
            }
        }
    }
}