{"record":{"id":"5cc05e7003244700","repo":"crowdsecurity/crowdsec","slug":"buildxpathquery-failed-w","errorCode":null,"errorMessage":"buildXpathQuery failed: %w","messagePattern":"buildXpathQuery failed: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/wineventlog/config_windows.go","lineNumber":247,"sourceCode":"\t\t\t\t\t\treturn fmt.Errorf(\"failed to parse event_id: %s\", err)\n\t\t\t\t\t}\n\t\t\t\t\ts.config.EventIDs = append(s.config.EventIDs, evtid)\n\t\t\t\t}\n\t\t\tcase \"event_level\":\n\t\t\t\tif len(value) != 1 {\n\t\t\t\t\treturn errors.New(\"event_level must be a single value\")\n\t\t\t\t}\n\t\t\t\ts.config.EventLevel = value[0]\n\t\t\t}\n\t\t}\n\t}\n\n\tvar err error\n\n\t// FIXME: handle custom xpath query\n\ts.query, err = s.buildXpathQuery()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"buildXpathQuery failed: %w\", err)\n\t}\n\n\ts.logger.Debugf(\"query: %s\\n\", s.query)\n\n\ts.evtConfig, err = s.generateConfig(s.query, false)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"generateConfig failed: %w\", err)\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":229,"sourceCodeEnd":259,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/wineventlog/config_windows.go#L229-L259","documentation":"In ConfigureByDSN, after DSN parameters are applied, the source builds the XPath query from the configured event IDs/levels via buildXpathQuery (custom XPath via DSN is not yet supported — see the FIXME). This error wraps any failure of that builder, meaning the event_id/event_level filters could not be converted into a valid XPath query for the Windows Event Log API.","triggerScenarios":"Calling ConfigureByDSN with a DSN whose event_id or event_level values, once parsed into Configuration, produce a filter buildXpathQuery cannot represent — e.g. an empty channel with filters, or values the builder deems invalid.","commonSituations":"DSNs missing the channel segment (args[0] empty) while filters are set, event_level names the builder does not map to known levels, or very large event_id lists producing malformed XPath.","solutions":["Check the wrapped inner error to identify which filter value failed.","Confirm the DSN's channel/file segment is present and correct, e.g. `wineventlog://Security?event_id=4625`.","Use standard event_level values (critical, error, warning, information, verbose).","If you need custom XPath filtering, use a YAML acquisition file with xpath_query instead of a DSN (DSN custom XPath is unimplemented)."],"exampleFix":"// before\nwineventlog://?event_level=err\n// after\nwineventlog://Security?event_level=error","handlingStrategy":"validation","validationCode":"if channel == \"\" && eventFile == \"\" {\n\treturn errors.New(\"DSN must specify a channel or event file\")\n}\nif !slices.Contains(levels, \"critical\") && !knownLevel(levels) { /* validate before calling */ }","typeGuard":null,"tryCatchPattern":"if err := src.ConfigureByDSN(ctx, dsn, labels, logger, uuid); err != nil {\n\tif strings.Contains(err.Error(), \"buildXpathQuery\") {\n\t\treturn fmt.Errorf(\"unsupported filters in DSN %q; use xpath_query in YAML config\", dsn)\n\t}\n\treturn err\n}","preventionTips":["Always include the channel segment in the DSN","Remember custom XPath via DSN is unsupported — use YAML config for that","Use standard event_level/event_id values"],"tags":["xpath","dsn","windows"],"backgroundTag":"invalid-config-value","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}