Drupal - How can I list only modules which need an update?

Drush puts that [ok] information out on stderr. So you can actually just dump that by using:

drush ups 2>/dev/null

which for me gave:

 $ drush ups 2>/dev/null
 Name    Installed Version  Proposed version  Message
 Drupal  8.2.5              8.2.6             Update available

Consider using 'grep'. It's not exactly a drush-specific command but will get the job done.

drush ups | grep 'Update available'

This command will return all lines that contain the phrase 'Update available'.

If your site is built with Composer you can use drush pm:security.

Check Drupal Composer packages for pending security updates.

This uses the Drupal security advisories package to determine if updates are available.

This will give you the following sample output:

+-------------+-------------------+-------------------+
| Name        | Installed Version | Suggested version |
+-------------+-------------------+-------------------+
| drupal/core | 8.6.7             | 8.6.10            |
+-------------+-------------------+-------------------+