{"record":{"id":"7e19fd650b806934","repo":"crowdsecurity/crowdsec","slug":"cannot-parse-wineventlog-configuration-s","errorCode":null,"errorMessage":"cannot parse wineventlog configuration: %s","messagePattern":"cannot parse wineventlog configuration: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/wineventlog/config_windows.go","lineNumber":138,"sourceCode":"\t\tif err != nil {\n\t\t\treturn &config, fmt.Errorf(\"windows.UTF16PtrFromString failed: %v\", err)\n\t\t}\n\t\tconfig.Flags = wevtapi.EvtQueryFilePath | wevtapi.EvtQueryForwardDirection\n\t}\n\tconfig.Query, err = windows.UTF16PtrFromString(query)\n\tif err != nil {\n\t\treturn &config, fmt.Errorf(\"windows.UTF16PtrFromString failed: %v\", err)\n\t}\n\n\treturn &config, nil\n}\n\nfunc (s *Source) UnmarshalConfig(yamlConfig []byte) error {\n\ts.config = Configuration{}\n\n\terr := yaml.UnmarshalWithOptions(yamlConfig, &s.config, yaml.Strict())\n\tif err != nil {\n\t\treturn fmt.Errorf(\"cannot parse wineventlog configuration: %s\", yaml.FormatError(err, false, false))\n\t}\n\n\tif s.config.EventChannel != \"\" && s.config.XPathQuery != \"\" {\n\t\treturn errors.New(\"event_channel and xpath_query are mutually exclusive\")\n\t}\n\n\tif s.config.EventChannel == \"\" && s.config.XPathQuery == \"\" {\n\t\treturn errors.New(\"event_channel or xpath_query must be set\")\n\t}\n\n\ts.config.Mode = configuration.TAIL_MODE\n\n\tif s.config.XPathQuery != \"\" {\n\t\ts.query = s.config.XPathQuery\n\t} else {\n\t\ts.query, err = s.buildXpathQuery()\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"buildXpathQuery failed: %v\", err)","sourceCodeStart":120,"sourceCodeEnd":156,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/wineventlog/config_windows.go#L120-L156","documentation":"UnmarshalConfig parses the wineventlog acquisition YAML into the Configuration struct using yaml.Strict(), which rejects any unknown field. This error means the YAML could not be decoded — either due to syntax errors, wrong types, or unknown keys — and it embeds the formatted yaml error. Strict mode is used so typos in config keys fail fast rather than being silently ignored.","triggerScenarios":"Calling UnmarshalConfig (invoked when loading acquisition files) with YAML that has invalid syntax, a key not present in the Configuration struct (e.g. `xpath-querry`), or a value whose type mismatches the struct field (e.g. `event_id: [abc]`).","commonSituations":"Typos in acquisition.yaml keys, indentation mistakes, using camelCase instead of snake_case keys, copying config from an older/newer crowdsec version with renamed fields, or tabs instead of spaces in YAML.","solutions":["Read the wrapped message (`yaml.FormatError(...)`) — it names the exact line/key that failed — and fix that key or value.","Validate YAML syntax with `yamllint` or an online parser; fix indentation and remove tabs.","Compare your keys against the documented wineventlog fields: event_channel, xpath_query, event_ids, event_levels, event_file, log_level, labels, etc. Use snake_case exactly.","Remove unknown/obsolete keys — strict parsing rejects anything not in the Configuration struct."],"exampleFix":"// before (acquis.yaml)\nsource: wineventlog\nEvent_Channel: System\nxpath_query: '*'\n// after\nsource: wineventlog\nevent_channel: System\nxpath_query: '*'","handlingStrategy":"validation","validationCode":"if err := yaml.UnmarshalWithOptions(data, &map[string]any{}, yaml.Strict()); err != nil { /* surface to user before deployment */ }\n// or lint at CI: yamllint acquis.d/*.yaml","typeGuard":null,"tryCatchPattern":"if err := src.UnmarshalConfig(yamlConfig); err != nil {\n\treturn fmt.Errorf(\"invalid wineventlog acquisition config: %w\", err)\n}","preventionTips":["Run yamllint on acquisition files in CI","Copy keys only from official docs — strict mode rejects unknown keys","Use spaces, not tabs, and consistent 2-space indentation","Validate config with `cscli` or a test crowdsec start before production"],"tags":["yaml","config","windows"],"backgroundTag":"yaml-parse-error","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}