{"record":{"id":"8b5ba99af38109c7","repo":"crowdsecurity/crowdsec","slug":"buildxpathquery-failed-v","errorCode":null,"errorMessage":"buildXpathQuery failed: %v","messagePattern":"buildXpathQuery failed: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/wineventlog/config_windows.go","lineNumber":156,"sourceCode":"\t\treturn fmt.Errorf(\"cannot parse wineventlog configuration: %s\", yaml.FormatError(err, false, false))\n\t}\n\n\tif s.config.EventChannel != \"\" && s.config.XPathQuery != \"\" {\n\t\treturn errors.New(\"event_channel and xpath_query are mutually exclusive\")\n\t}\n\n\tif s.config.EventChannel == \"\" && s.config.XPathQuery == \"\" {\n\t\treturn errors.New(\"event_channel or xpath_query must be set\")\n\t}\n\n\ts.config.Mode = configuration.TAIL_MODE\n\n\tif s.config.XPathQuery != \"\" {\n\t\ts.query = s.config.XPathQuery\n\t} else {\n\t\ts.query, err = s.buildXpathQuery()\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"buildXpathQuery failed: %v\", err)\n\t\t}\n\t}\n\n\tif s.config.PrettyName != \"\" {\n\t\ts.name = s.config.PrettyName\n\t} else {\n\t\ts.name = s.query\n\t}\n\n\treturn nil\n}\n\nfunc (s *Source) Configure(ctx context.Context, yamlConfig []byte, logger *log.Entry, metricsLevel metrics.AcquisitionMetricsLevel) error {\n\ts.logger = logger\n\ts.metricsLevel = metricsLevel\n\n\terr := s.UnmarshalConfig(yamlConfig)\n\tif err != nil {","sourceCodeStart":138,"sourceCodeEnd":174,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/wineventlog/config_windows.go#L138-L174","documentation":"When xpath_query is not set in the YAML config, UnmarshalConfig calls buildXpathQuery to synthesize an XPath query from the event_ids/event_levels fields. This error wraps any failure from that builder. It means the configured event ID/level filters could not be turned into a valid XPath expression.","triggerScenarios":"Omitting xpath_query while providing event_ids/event_levels values that buildXpathQuery cannot represent — e.g. invalid level names or an empty/unparseable filter set — causing the internal builder to return an error.","commonSituations":"Users writing `event_levels: [warning, fatal]` with level names the builder doesn't recognize, malformed event_ids entries in the YAML config, or combining fields in a way the builder rejects.","solutions":["Read the wrapped inner error from buildXpathQuery to see which filter value is rejected.","Use canonical Windows event level names/numbers (Critical, Error, Warning, Information, Verbose) in event_levels.","Simplify: set an explicit `xpath_query: '*[*]'` or a well-formed XPath instead of relying on the builder.","Test the generated XPath in Windows Event Viewer's 'Filter Current Log' XML tab before deploying."],"exampleFix":"// before\nsource: wineventlog\nevent_channel: System\nevent_levels: [warn, fatal]\n// after\nsource: wineventlog\nevent_channel: System\nevent_levels: [warning, critical]","handlingStrategy":"validation","validationCode":"for _, lvl := range cfg.EventLevels {\n\tif !slices.Contains([]string{\"critical\",\"error\",\"warning\",\"information\",\"verbose\"}, strings.ToLower(lvl)) {\n\t\treturn fmt.Errorf(\"unknown event level %q\", lvl)\n\t}\n}","typeGuard":null,"tryCatchPattern":"if err := src.UnmarshalConfig(data); err != nil {\n\tif strings.Contains(err.Error(), \"buildXpathQuery\") {\n\t\t// fall back to a permissive query\n\t\tcfg.XPathQuery = \"*[EventData]\"\n\t\treturn src.UnmarshalConfig(data)\n\t}\n\treturn err\n}","preventionTips":["Prefer explicit xpath_query for non-trivial filters","Stick to canonical Windows event level names","Test generated XPath in Event Viewer's XML filter tab"],"tags":["xpath","config","windows"],"backgroundTag":"invalid-config-value","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}