{"record":{"id":"b1b062ef7525859d","repo":"crowdsecurity/crowdsec","slug":"event-channel-or-xpath-query-must-be-set","errorCode":null,"errorMessage":"event_channel or xpath_query must be set","messagePattern":"event_channel or xpath_query must be set","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/wineventlog/config_windows.go","lineNumber":146,"sourceCode":"\t}\n\n\treturn &config, nil\n}\n\nfunc (s *Source) UnmarshalConfig(yamlConfig []byte) error {\n\ts.config = Configuration{}\n\n\terr := yaml.UnmarshalWithOptions(yamlConfig, &s.config, yaml.Strict())\n\tif err != nil {\n\t\treturn fmt.Errorf(\"cannot parse wineventlog configuration: %s\", yaml.FormatError(err, false, false))\n\t}\n\n\tif s.config.EventChannel != \"\" && s.config.XPathQuery != \"\" {\n\t\treturn errors.New(\"event_channel and xpath_query are mutually exclusive\")\n\t}\n\n\tif s.config.EventChannel == \"\" && s.config.XPathQuery == \"\" {\n\t\treturn errors.New(\"event_channel or xpath_query must be set\")\n\t}\n\n\ts.config.Mode = configuration.TAIL_MODE\n\n\tif s.config.XPathQuery != \"\" {\n\t\ts.query = s.config.XPathQuery\n\t} else {\n\t\ts.query, err = s.buildXpathQuery()\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"buildXpathQuery failed: %v\", err)\n\t\t}\n\t}\n\n\tif s.config.PrettyName != \"\" {\n\t\ts.name = s.config.PrettyName\n\t} else {\n\t\ts.name = s.query\n\t}","sourceCodeStart":128,"sourceCodeEnd":164,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/wineventlog/config_windows.go#L128-L164","documentation":"The wineventlog acquisition source requires exactly one way to select events: either an explicit channel name (event_channel) or a custom XPath filter (xpath_query). At config unmarshal time, if both are empty the source has no event selection, so UnmarshalConfig rejects the configuration.","triggerScenarios":"Loading a YAML acquisition file where a wineventlog source stanza omits both 'event_channel' and 'xpath_query' keys, or both are set to empty strings after config parsing.","commonSituations":"Copy-pasting an acquisition template and deleting the channel line without adding an xpath_query; building config programmatically and forgetting to set either field; typos like 'event-channel' or 'xpathquery' so neither recognized key is populated.","solutions":["Add 'event_channel: <ChannelName>' (e.g. Security, System, Application) to the wineventlog source config","Or add 'xpath_query: <XPath expression>' for custom event filtering","Check for key typos and correct indentation so the keys land under the right source stanza"],"exampleFix":"// before\nsource: wineventlog\n// after\nsource: wineventlog\nevent_channel: Security","handlingStrategy":"validation","validationCode":"// Go: validate wineventlog config before writing/acquiring\nif cfg.EventChannel == \"\" && cfg.XPathQuery == \"\" {\n    return fmt.Errorf(\"wineventlog source needs event_channel or xpath_query\")\n}\nif cfg.EventChannel != \"\" && cfg.XPathQuery != \"\" {\n    return fmt.Errorf(\"event_channel and xpath_query are mutually exclusive\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always set exactly one of event_channel or xpath_query per wineventlog source","Use correct snake_case key names in acquisition YAML","Validate acquisition files with cscli before restart"],"tags":["windows","acquisition","config","wineventlog"],"backgroundTag":"missing-required-config-field","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}