# syft -o: Output Formats and Multiple Files

> syft -o selects the SBOM format and can write several at once. Reference for the format names, the =file syntax, and CI errors.

Source: https://latchkey.dev/learn/command-reference/syft-output-formats  
Updated: 2026-06-30

syft -o selects one or more SBOM output formats and can write each to its own file in a single run.

syft supports many SBOM encodings. The -o flag chooses them, and because it is repeatable you can emit, say, a human table to the log and a CycloneDX JSON to disk at once.

## What it does

syft -o <format> picks an output encoding; appending =<file> writes that format to a file instead of stdout. The flag is repeatable, so one scan can produce several formats. Format names include syft-json, table, cyclonedx-json, cyclonedx-xml, spdx-json, and spdx-tag-value.

## Common usage

```Terminal
syft myorg/app:ci -o table
# two formats at once: table to the log, CycloneDX to a file
syft myorg/app:ci -o table -o cyclonedx-json=sbom.cdx.json
syft myorg/app:ci -o spdx-json=sbom.spdx.json -o syft-json=sbom.syft.json
```

## Options

| Format | What it is |
| --- | --- |
| syft-json | Syft native JSON, the richest representation |
| table | Human-readable table for logs |
| cyclonedx-json / -xml | CycloneDX SBOM in JSON or XML |
| spdx-json | SPDX SBOM in JSON |
| spdx-tag-value | SPDX in the tag:value text format |
| <fmt>=<file> | Write that format to a file |

## In CI

Emit a table to stdout for quick log review and a machine format (cyclonedx-json or spdx-json) to a file for artifacts and attestation, all in one syft invocation. Prefer syft-json as the internal artifact since grype reads it losslessly.

## Common errors in CI

"unknown output format" means a misspelled name; the correct spellings use hyphens (cyclonedx-json, not cyclonedx_json). Writing two formats to stdout (both without =file) interleaves them into unusable output; give at least all but one an =file target.

## FAQ

### syft -o: Output Formats and Multiple Files?

syft supports many SBOM encodings. The -o flag chooses them, and because it is repeatable you can emit, say, a human table to the log and a CycloneDX JSON to disk at once.

### What it does?

syft -o <format> picks an output encoding; appending =<file> writes that format to a file instead of stdout. The flag is repeatable, so one scan can produce several formats. Format names include syft-json, table, cyclonedx-json, cyclonedx-xml, spdx-json, and spdx-tag-value.

### In CI?

Emit a table to stdout for quick log review and a machine format (cyclonedx-json or spdx-json) to a file for artifacts and attestation, all in one syft invocation. Prefer syft-json as the internal artifact since grype reads it losslessly.

### Common errors in CI?

"unknown output format" means a misspelled name; the correct spellings use hyphens (cyclonedx-json, not cyclonedx_json). Writing two formats to stdout (both without =file) interleaves them into unusable output; give at least all but one an =file target.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt