{"record":{"id":"927f83c5803e5bd5","repo":"crowdsecurity/crowdsec","slug":"event-level-must-be-a-single-value","errorCode":null,"errorMessage":"event_level must be a single value","messagePattern":"event_level must be a single value","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/wineventlog/config_windows.go","lineNumber":235,"sourceCode":"\t\t\t\tif len(value) != 1 {\n\t\t\t\t\treturn errors.New(\"log_level must be a single value\")\n\t\t\t\t}\n\t\t\t\tlvl, err := log.ParseLevel(value[0])\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"failed to parse log_level: %s\", err)\n\t\t\t\t}\n\t\t\t\ts.logger.Logger.SetLevel(lvl)\n\t\t\tcase \"event_id\":\n\t\t\t\tfor _, id := range value {\n\t\t\t\t\tevtid, err := strconv.Atoi(id)\n\t\t\t\t\tif err != nil {\n\t\t\t\t\t\treturn fmt.Errorf(\"failed to parse event_id: %s\", err)\n\t\t\t\t\t}\n\t\t\t\t\ts.config.EventIDs = append(s.config.EventIDs, evtid)\n\t\t\t\t}\n\t\t\tcase \"event_level\":\n\t\t\t\tif len(value) != 1 {\n\t\t\t\t\treturn errors.New(\"event_level must be a single value\")\n\t\t\t\t}\n\t\t\t\ts.config.EventLevel = value[0]\n\t\t\t}\n\t\t}\n\t}\n\n\tvar err error\n\n\t// FIXME: handle custom xpath query\n\ts.query, err = s.buildXpathQuery()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"buildXpathQuery failed: %w\", err)\n\t}\n\n\ts.logger.Debugf(\"query: %s\\n\", s.query)\n\n\ts.evtConfig, err = s.generateConfig(s.query, false)\n\tif err != nil {","sourceCodeStart":217,"sourceCodeEnd":253,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/wineventlog/config_windows.go#L217-L253","documentation":"In the DSN query string, the 'event_level' parameter must appear exactly once. Because url.ParseQuery collects repeated keys into a slice, multiple event_level entries cannot be mapped to a single EventLevel config value and are rejected.","triggerScenarios":"ConfigureByDSN with a DSN like wineventlog://Security?event_level=error&event_level=warning — the event_level key occurs more than once in the query string.","commonSituations":"Attempting to subscribe to multiple levels via repeated parameters; templated DSNs that append event_level unconditionally even when already present; copy-paste duplication when editing a DSN.","solutions":["Specify a single event_level value in the DSN","To filter multiple levels, use event_level with a comma-separated value or an xpath_query instead, per the module's supported syntax","Deduplicate parameters when building the DSN programmatically"],"exampleFix":"// before\nwineventlog://Security?event_level=error&event_level=warning\n// after\nwineventlog://Security?event_level=error,warning","handlingStrategy":"validation","validationCode":"// Go: ensure a single event_level value before building the DSN\nparams := url.Values{}\nparams.Set(\"event_level\", \"error,warning\") // one key, combined value","typeGuard":null,"tryCatchPattern":"if err := src.ConfigureByDSN(dsn); err != nil {\n    return fmt.Errorf(\"bad wineventlog DSN params: %w\", err)\n}","preventionTips":["Pass multiple levels as one combined value or switch to xpath_query","Use url.Values.Set to guarantee single-occurrence keys","Review templated DSNs for unconditionally appended duplicate parameters"],"tags":["windows","acquisition","dsn","wineventlog"],"backgroundTag":"invalid-query-parameter","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}