CLI Reference
backend
formats

`rsigma backend formats`

List the output formats supported by one backend.

Synopsis

rsigma backend formats [OPTIONS] <TARGET>

Description

Prints every -f <FORMAT> value backend convert accepts for the given backend. Each entry has a short description.

Flags

Flag	Description
`<TARGET>`	Backend name (e.g. `postgres`, `lynxdb`, `test`). Use `backend targets` for the list.

Examples

PostgreSQL formats

rsigma backend formats postgres

Available formats for 'postgres':
  default               - Plain PostgreSQL SQL
  view                  - CREATE OR REPLACE VIEW for each rule
  timescaledb           - TimescaleDB-optimized queries with time_bucket()
  continuous_aggregate  - CREATE MATERIALIZED VIEW ... WITH (timescaledb.continuous)
  sliding_window        - Correlation queries using window functions for per-row sliding detection

LynxDB formats

rsigma backend formats lynxdb

Available formats for 'lynxdb':
  default  - Full SPL2 with `FROM <index> | search ...`
  minimal  - Just the search expression, for use as a REST API `q=` parameter

Exit codes

Code	Meaning
`0`	Always (the command is informational and does not propagate an unknown-target argument to a non-zero exit).

Unknown backend names print Unknown target: <name> followed by the list of available targets, but the process still exits 0. To validate a target in CI before passing it to backend convert, parse this output or, better, hard-code the supported target list since the set is small and changes rarely.