{"record":{"id":"523fbbeee2b44f38","repo":"crowdsecurity/crowdsec","slug":"invalid-log-level","errorCode":null,"errorMessage":"invalid log level","messagePattern":"invalid log level","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/wineventlog/config_windows.go","lineNumber":54,"sourceCode":"type Select struct {\n\tPath  string `xml:\"Path,attr,omitempty\"`\n\tQuery string `xml:\",chardata\"`\n}\n\nfunc logLevelToInt(logLevel string) ([]string, error) {\n\tswitch strings.ToUpper(logLevel) {\n\tcase \"CRITICAL\":\n\t\treturn []string{\"1\"}, nil\n\tcase \"ERROR\":\n\t\treturn []string{\"2\"}, nil\n\tcase \"WARNING\":\n\t\treturn []string{\"3\"}, nil\n\tcase \"INFORMATION\":\n\t\treturn []string{\"0\", \"4\"}, nil\n\tcase \"VERBOSE\":\n\t\treturn []string{\"5\"}, nil\n\tdefault:\n\t\treturn nil, errors.New(\"invalid log level\")\n\t}\n}\n\nfunc (s *Source) buildXpathQuery() (string, error) {\n\tvar query string\n\tqueryComponents := [][]string{}\n\tif s.config.EventIDs != nil {\n\t\teventIds := []string{}\n\t\tfor _, id := range s.config.EventIDs {\n\t\t\teventIds = append(eventIds, fmt.Sprintf(\"EventID=%d\", id))\n\t\t}\n\t\tqueryComponents = append(queryComponents, eventIds)\n\t}\n\tif s.config.EventLevel != \"\" {\n\t\tlevels, err := logLevelToInt(s.config.EventLevel)\n\t\tlogLevels := []string{}\n\t\tif err != nil {\n\t\t\treturn \"\", err","sourceCodeStart":36,"sourceCodeEnd":72,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/wineventlog/config_windows.go#L36-L72","documentation":"The wineventlog source maps a configured 'level' string to Windows event level IDs via logLevelToInt. Only CRITICAL/ERROR/WARNING/INFORMATION/VERBOSE are accepted; any other value returns 'invalid log level' while buildXpathQuery builds the event query.","triggerScenarios":"UnmarshalConfig/DSN sets level to an unknown string (e.g. 'info', 'debug', 'critical' lowercase variants depending on accepted set, 'trace'), which buildXpathQuery cannot map.","commonSituations":"Typo in the level key; using generic 'info'/'debug' conventions instead of the Windows level names; copying config from another log source with different level vocabulary.","solutions":["Set level to one of: CRITICAL, ERROR, WARNING, INFORMATION, VERBOSE","Check the exact accepted values in the wineventlog docs/source (case matters)","Remove the level option to use the default filter if you don't need one"],"exampleFix":"// before\nlevel: info\n// after\nlevel: INFORMATION","handlingStrategy":"validation","validationCode":"validLevels := map[string]bool{\"CRITICAL\":true,\"ERROR\":true,\"WARNING\":true,\"INFORMATION\":true,\"VERBOSE\":true}\nif level != \"\" && !validLevels[level] { return fmt.Errorf(\"level %q not supported\", level) }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use the exact Windows event level names (uppercase)","Check docs for accepted level values before adding the key","Omit level entirely to use defaults when unsure"],"tags":["wineventlog","windows","configuration"],"backgroundTag":"invalid-enum-value","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}