Skip to main content
Version: Tenzir v4.3


Consumes events by combining a connector and a format.


to <connector> [write <format>]


The to operator consumes events at the end of a pipeline by bringing together a connector and a format.

All connectors have a default format, which depends on the connector. This enables a shorter syntax, e.g., to stdout uses the json format, while to file foo.csv uses the csv format.

The to operator is a pipeline under the hood. For most cases, it is equal to write <format> | save <connector>. However, for some combinations of connectors and formats the underlying pipeline is a bit more complex. We recommend always using to ... write ... over the write and save operators.


The connector used to save bytes.

Some connectors have connector-specific options. Please refer to the documentation of the individual connectors for more information.


The format used to print events to bytes.

Some formats have format-specific options. Please refer to the documentation of the individual formats for more information.


Write events to stdout formatted as CSV.

to stdout write csv

Write events to the file path/to/eve.json formatted as JSON.

to file path/to/eve.json write json