reference Flags

--incremental-output

Accepted by
opengrep scan
See also
--json, --output, --jobs, --no-progress-bar

By default, Opengrep prints the output when the scan ends. With this flag, it prints each finding as soon as it is found.

The flag changes the JSON output. Instead of one document with a results array, Opengrep prints one JSON object per finding, each on its own line, as newline-delimited JSON. The other fields of the JSON document, such as version, errors and paths, are not printed.

--incremental-output-postprocess, together with --incremental-output, applies the post-processing steps to the stream.

Examples

One object per finding

rule.yaml
rules:  - id: find-eval    pattern: eval(...)    message: found eval    languages: [python]    severity: WARNING
app.py
eval(1)eval(2)
Command and result
$ opengrep scan --config rule.yaml --json app.py 2>/dev/null | jq .
{
  "version": "X.Y.Z",
  "results": [
    {
      "check_id": "find-eval",
      "path": "app.py",
      "start": {
        "line": 1,
        "col": 1,
        "offset": 0
      },
      "end": {
        "line": 1,
        "col": 8,
        "offset": 7
      },
      "extra": {
        "metavars": {},
        "message": "found eval",
        "metadata": {},
        "severity": "WARNING",
        "fingerprint": "cc2ee9ac3b87e874db7ede72562f586db0607e44a6ebc8879fc1772bd2699a2f302d90e0cf6bde9dce450cb0891646fb0b3d70263351681e1d2e48ca0d26d960_0",
        "lines": "eval(1)",
        "is_ignored": false,
        "validation_state": "NO_VALIDATOR",
        "engine_kind": "Opengrep"
      }
    },
    {
      "check_id": "find-eval",
      "path": "app.py",
      "start": {
        "line": 2,
        "col": 1,
        "offset": 8
      },
      "end": {
        "line": 2,
        "col": 8,
        "offset": 15
      },
      "extra": {
        "metavars": {},
        "message": "found eval",
        "metadata": {},
        "severity": "WARNING",
        "fingerprint": "cc2ee9ac3b87e874db7ede72562f586db0607e44a6ebc8879fc1772bd2699a2f302d90e0cf6bde9dce450cb0891646fb0b3d70263351681e1d2e48ca0d26d960_1",
        "lines": "eval(2)",
        "is_ignored": false,
        "validation_state": "NO_VALIDATOR",
        "engine_kind": "Opengrep"
      }
    }
  ],
  "errors": [],
  "paths": {
    "scanned": [
      "app.py"
    ]
  },
  "interfile_languages_used": [],
  "skipped_rules": []
}
$ opengrep scan --config rule.yaml --json --incremental-output app.py 2>/dev/null
{"check_id":"find-eval","path":"app.py","start":{"line":1,"col":1,"offset":0},"end":{"line":1,"col":8,"offset":7},"extra":{"metavars":{},"message":"found eval","metadata":{},"severity":"WARNING","fingerprint":"cc2ee9ac3b87e874db7ede72562f586db0607e44a6ebc8879fc1772bd2699a2f302d90e0cf6bde9dce450cb0891646fb0b3d70263351681e1d2e48ca0d26d960","lines":"eval(1)","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"Opengrep"}}
{"check_id":"find-eval","path":"app.py","start":{"line":2,"col":1,"offset":8},"end":{"line":2,"col":8,"offset":15},"extra":{"metavars":{},"message":"found eval","metadata":{},"severity":"WARNING","fingerprint":"cc2ee9ac3b87e874db7ede72562f586db0607e44a6ebc8879fc1772bd2699a2f302d90e0cf6bde9dce450cb0891646fb0b3d70263351681e1d2e48ca0d26d960","lines":"eval(2)","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"Opengrep"}}

The first command prints one document, formatted by jq. The second prints one JSON object per finding, each on a line of its own; together the lines are not a single JSON document.