Skip to main content

Output formats

When rtl_433 decodes a message it has to render that record somewhere. Two options control this: -F selects the output format (and where it goes), and -M adds metadata to every output line. Both options can be given multiple times, so a single run can, for example, print human-readable text to the console while also appending JSON to a file and publishing to MQTT.

Defaults

Without any -F option the default output is LOG and KV. Use -F null to remove the default output — useful when you only want one of the machine-readable formats.

Selecting a format with -F​

The -F option takes one of the following formats:

-F log | kv | json | csv | mqtt | influx | syslog | trigger | rtl_tcp | http | null | help

By default each format writes to stdout. To append to a file instead, add :<filename>:

# Append CSV records to a file (as documented in the man page)
rtl_433 -F csv:log.csv

Because -F can be repeated, you can fan out the same decoded stream to several destinations at once:

# Human-readable KV on the console, JSON appended to a file
rtl_433 -F kv -F json:events.json

What each format produces​

FormatDescription
logHuman-readable log lines (part of the default output).
kvKey-value text, one labelled field per line — the default human-readable record.
jsonOne JSON object per decoded message; ideal for piping into other tools.
csvComma-separated values with a header row; convenient for spreadsheets.
mqttPublishes records to an MQTT broker.
influxWrites to an InfluxDB time-series database.
syslogSends records as syslog messages over UDP.
triggerWrites a 1 to a path for each event (e.g. to drive a GPIO).
rtl_tcpAdds an rtl_tcp pass-through server.
httpStarts an HTTP API server with a browser UI.
nullProduces no output; used to suppress the default LOG/KV output.
tip
Run -F help

Pass any of -d, -g, -R, -X, -F, -M, -r, -w, or -W without an argument (for example -F help) to print the detailed help for that option, including the exact sub-option syntax.

Network and service formats​

Several formats accept a host/port and additional options.

MQTT​

-F mqtt[s][:[//]host[:port][,<options>]]   (default: localhost:1883)

MQTT options are user=foo, pass=bar, retain[=0|1], and <format>[=topic]. The default user and password are read from the MQTT_USERNAME and MQTT_PASSWORD environment variables. The supported MQTT formats (the default is all of them) are:

  • availability — posts availability (online/offline)
  • events — posts JSON event data, default topic <base>/events
  • states — posts JSON state data, default topic <base>/states
  • devices — posts device and sensor info in nested topics, default <base>/devices[/type][/model][/subtype][/channel][/id]

A base topic can be set with base=<topic>; the default is rtl_433/HOSTNAME. Use mqtts:// with tls_cert, tls_key, and tls_ca_cert for TLS.

# Verbatim from the rtl_433 man page
rtl_433 -F "mqtt://localhost:1883,user=USERNAME,pass=PASSWORD,retain=0,devices=rtl_433[/id]"
One driver per MQTT instance

With MQTT each rtl_433 instance needs a distinct driver selection. The MQTT Client-ID is computed from the driver string, so if you run multiple RTL-SDR dongles, set a serial and select by it.

InfluxDB​

-F influx[:[//]host[:port][/<path and options>]]
# InfluxDB 2.0
rtl_433 -F "influx://localhost:9999/api/v2/write?org=<org>&bucket=<bucket>,token=<authtoken>"

# InfluxDB 1.x
rtl_433 -F "influx://localhost:8086/write?db=<db>&p=<password>&u=<user>"

The man page recommends adding -M time:unix:usec:utc for correct timestamps in InfluxDB.

Syslog​

-F syslog[:[//]host[:port]]   (default: localhost:514)
rtl_433 -F syslog:127.0.0.1:1514

HTTP​

-F http[:[//]bind[:port]]   (default: 0.0.0.0:8433)

This adds an HTTP API server; a UI is reachable at e.g. http://localhost:8433/.

Adding metadata with -M​

The -M option attaches extra metadata to every output line. It accepts:

-M time[:<options>] | protocol | level | noise[:<secs>] | stats | bits | help
OptionEffect
timeAdd current date and time (preset for live inputs).
time:relAdd sample-position metadata (preset for read-file and stdin).
time:unixSeconds since the Unix epoch; always UTC.
time:isoISO-8601 format, YYYY-MM-DDThh:mm:ss.
time:offRemove time metadata.
time:usecAdd microseconds to the date/time.
time:tzOutput time with timezone offset.
time:utcOutput time in UTC.
protocol / noprotocolAdd or remove the decoder protocol number.
levelAdd Modulation, Frequency, RSSI, SNR, and Noise.
noise[:<secs>]Report estimated noise level at intervals (default: 10 seconds).
stats[:[<level>][:<interval>]]Report statistics (default: 600 seconds).
bitsAdd the bit representation to code outputs (for debug).

The usec and utc modifiers can be combined with other time options, for example time:iso:utc or time:unix:usec. As noted above, time:unix:usec:utc is recommended when writing to InfluxDB.

For stats, the reporting level is: 0 no report, 1 report successful devices, 2 report active devices, 3 report all.

# Report microsecond-accurate timestamps and add reception levels
rtl_433 -M time:usec -M level

Writing to stdout vs. a file​

  • stdout is the default destination for every -F format. This makes piping natural.
  • Append the format to a file with :<filename>, e.g. -F json:events.json.
# Pipe JSON, in UTC, into an MQTT publisher (from the README examples)
rtl_433 -F json -M utc | mosquitto_pub -t home/rtl_433 -l

Illustrative example. The block below shows the shape of JSON output for one decoded message. The exact fields depend on the device that transmitted; field semantics are documented in the project's data-format reference.

{"time":"2026-05-30 14:02:18","model":"Acurite-Tower","id":11524,"channel":"A","temperature_C":21.3,"humidity":48,"battery_ok":1,"mic":"CHECKSUM"}
Suppress the default, keep only one machine format

Combine -F null with the format you want to keep the console clean while logging structured data:

rtl_433 -F null -F json:events.json

Sources​