--output option, the configured default, and the notes that tables add below the rows.
Choosing a format
--format selects the format. --json and --jsonl are short for --format json and --format jsonl. Not every command prints every format:
A format that a command cannot print is an invalid argument: the command names the formats it accepts and exits with 2.
Table
Tables are for reading. Byte counts and rates are rounded to three significant digits in units of 1024 (KB, MB, GB), times are local, protocols and states are in upper case, and a value that is not known shows as -.
The footer
Below the rows offiles, transfers, processes, connections, flows and top, a line says from when the agent has been observing: Observed since <time>. History is not kept across agent restarts. When nothing matched, it says No <records> observed since <time>. instead, so an empty answer is never mistaken for a complete one. History is kept in memory and starts when the agent starts.
events ends with the number of events and how far back its event log reaches, and inspect ends with the time its history starts. Machine-readable formats print no footer; inspect --json carries the same time as observed_since.
The confidence marker
A* after a confidence level, as in EXACT*, marks a transfer during which the agent lost events, so its byte count may be low. The table then ends with this note:
"incomplete": true.
Colors
On a terminal, headers are bold and footers dim. Output to a pipe or a file,--output, a non-empty NO_COLOR and TERM=dumb all turn styling off.
JSON
--json prints one array; each record is an object on a line of its own:
null or zero. For example, transfer.bytes_read appears only for read-write transfers, the file object is absent for sent bytes that no file accounts for, and remote_host appears only with --resolve-hostnames. A transfer has the same fields whether it comes from files, transfers or inspect. JSON output schema lists every field of every command.
JSON Lines
--jsonl prints one object per line with no enclosing array, which suits streaming and line-oriented tools:
CSV
--format csv prints a header row with the field names, then one row per record. Nested fields are named with a dot (process.pid, transfer.bytes_sent), a field that is not known is empty, lists such as transfer.evidence are joined with ;, and booleans are true or false. A value that contains a comma, a quote or a line break is quoted.
Quiet
--format quiet prints one identifier per row and nothing else, for use in shell pipelines:
inspect takes, so a quiet listing can feed it:
Exact values in machine formats
JSON, JSON Lines, CSV and quiet output carry exact values: byte counts and rates are whole numbers of bytes and bytes per second, durations are milliseconds, and timestamps are RFC 3339 in UTC with milliseconds. The transfer that a table shows as47.7 MB has "bytes_sent":50000000 in JSON, and its start time is "started":"2026-11-11T20:07:56.063Z".
Byte counts are what the local socket accepted, not bytes on the wire or bytes the remote end acknowledged.
Writing to a file
--output <file> writes the result to a file instead of standard output. The file is created, or truncated if it exists. Warnings and errors still go to standard error.
--output is never styled, and top leaves out its heading line. For stats, doctor and capabilities, which have no --output, redirect standard output instead.
The configured default
The[output] format setting of the configuration file sets the default format:
format = "jsonl", files prints JSON Lines and inspect prints a table; with format = "json", inspect, stats, doctor and capabilities print JSON too. An option on the command line always wins.
timestamps = false leaves the time out of each event in the table format of events, and out of the separator line between snapshots of watch --no-ui.