reference Flags

--output

Accepted by
opengrep scan, opengrep ci
Also spelled
-o
Value
FILE
See also
--json, --text, --emacs, --vim, --sarif, --emacs-output, --files-with-matches, --gitlab-sast-output, --gitlab-sast, --gitlab-secrets-output, --gitlab-secrets, --incremental-output, --json-output, --junit-xml-output, --junit-xml, --sarif-output, --text-output, --vim-output

Writes the output to FILE instead of standard output. Standard output remains empty; the progress and the summary still go to standard error. The format is the one the scan would print, so -o writes the text output unless --json, --sarif or another format flag is given.

To show the output on the terminal and also write it to a file, use the flags of the formats instead: --text-output, --json-output, --emacs-output, --vim-output, --sarif-output, --gitlab-sast-output, --gitlab-secrets-output and --junit-xml-output. Each can be repeated, and they can be combined with each other, with -o, and with any format on standard output.

These rules apply to all output files:

Examples

Writing the report to a file

rule.yaml
rules:  - id: find-eval    pattern: eval(...)    message: found eval    languages: [python]    severity: WARNING
app.py
eval(1)
Command and result
$ opengrep scan -q --config rule.yaml -o findings.txt app.py
$ cat findings.txt
app.py

  warn  find-eval
  found eval

     1: eval(1)

The first command prints nothing: the output went to the file.

JSON in one file, SARIF in another

rule.yaml
rules:  - id: find-eval    pattern: eval(...)    message: found eval    languages: [python]    severity: WARNING
app.py
eval(1)
Command and result
$ opengrep scan --config rule.yaml --json -o findings.json --sarif-output findings.sarif app.py 2>/dev/null
$ jq . findings.json
{
  "version": "X.Y.Z",
  "results": [
    {
      "check_id": "find-eval",
      "path": "app.py",
      "start": {
        "line": 1,
        "col": 1,
        "offset": 0
      },
      "end": {
        "line": 1,
        "col": 8,
        "offset": 7
      },
      "extra": {
        "metavars": {},
        "message": "found eval",
        "metadata": {},
        "severity": "WARNING",
        "fingerprint": "cc2ee9ac3b87e874db7ede72562f586db0607e44a6ebc8879fc1772bd2699a2f302d90e0cf6bde9dce450cb0891646fb0b3d70263351681e1d2e48ca0d26d960_0",
        "lines": "eval(1)",
        "is_ignored": false,
        "validation_state": "NO_VALIDATOR",
        "engine_kind": "Opengrep"
      }
    }
  ],
  "errors": [],
  "paths": {
    "scanned": [
      "app.py"
    ]
  },
  "interfile_languages_used": [],
  "skipped_rules": []
}
$ jq . findings.sarif
{
  "version": "2.1.0",
  "runs": [
    {
      "invocations": [
        {
          "executionSuccessful": true,
          "toolExecutionNotifications": []
        }
      ],
      "results": [
        {
          "fingerprints": {
            "matchBasedId/v1": "cc2ee9ac3b87e874db7ede72562f586db0607e44a6ebc8879fc1772bd2699a2f302d90e0cf6bde9dce450cb0891646fb0b3d70263351681e1d2e48ca0d26d960_0"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "app.py",
                  "uriBaseId": "%SRCROOT%"
                },
                "region": {
                  "endColumn": 8,
                  "endLine": 1,
                  "snippet": {
                    "text": "eval(1)"
                  },
                  "startColumn": 1,
                  "startLine": 1
                }
              }
            }
          ],
          "message": {
            "text": "found eval"
          },
          "properties": {},
          "ruleId": "find-eval"
        }
      ],
      "tool": {
        "driver": {
          "name": "Opengrep",
          "rules": [
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "found eval"
              },
              "help": {
                "markdown": "found eval",
                "text": "found eval"
              },
              "id": "find-eval",
              "name": "find-eval",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Opengrep Finding: find-eval"
              }
            }
          ],
          "semanticVersion": "X.Y.Z"
        }
      }
    }
  ],
  "$schema": "https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/schemas/sarif-schema-2.1.0.json"
}

Two formats, one file

rule.yaml
rules:  - id: find-eval    pattern: eval(...)    message: found eval    languages: [python]    severity: WARNING
app.py
eval(1)
Command and result
$ opengrep scan --config rule.yaml --json-output findings.out --sarif-output findings.out app.py 2>&1; echo "exit status: $?"
[00.00][ERROR]: Cannot write both --json-output and --sarif-output to findings.out
exit status: 2
$ test -e findings.out || echo "no file written"
no file written
rule.yaml
rules:  - id: find-eval    pattern: eval(...)    message: found eval    languages: [python]    severity: WARNING
app.py
eval(1)
Command and result
$ printf 'keep me\n' > notes.txt
$ ln -s notes.txt findings.txt
$ opengrep scan --config rule.yaml -o findings.txt app.py 2>&1 | grep symlink
error    Output is symlink: findings.txt
$ cat notes.txt
keep me