{"record":{"id":"ef7e594293ad96c2","repo":"crowdsecurity/crowdsec","slug":"event-channel-and-xpath-query-are-mutually-exclusi","errorCode":null,"errorMessage":"event_channel and xpath_query are mutually exclusive","messagePattern":"event_channel and xpath_query are mutually exclusive","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/wineventlog/config_windows.go","lineNumber":142,"sourceCode":"\t}\n\tconfig.Query, err = windows.UTF16PtrFromString(query)\n\tif err != nil {\n\t\treturn &config, fmt.Errorf(\"windows.UTF16PtrFromString failed: %v\", err)\n\t}\n\n\treturn &config, nil\n}\n\nfunc (s *Source) UnmarshalConfig(yamlConfig []byte) error {\n\ts.config = Configuration{}\n\n\terr := yaml.UnmarshalWithOptions(yamlConfig, &s.config, yaml.Strict())\n\tif err != nil {\n\t\treturn fmt.Errorf(\"cannot parse wineventlog configuration: %s\", yaml.FormatError(err, false, false))\n\t}\n\n\tif s.config.EventChannel != \"\" && s.config.XPathQuery != \"\" {\n\t\treturn errors.New(\"event_channel and xpath_query are mutually exclusive\")\n\t}\n\n\tif s.config.EventChannel == \"\" && s.config.XPathQuery == \"\" {\n\t\treturn errors.New(\"event_channel or xpath_query must be set\")\n\t}\n\n\ts.config.Mode = configuration.TAIL_MODE\n\n\tif s.config.XPathQuery != \"\" {\n\t\ts.query = s.config.XPathQuery\n\t} else {\n\t\ts.query, err = s.buildXpathQuery()\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"buildXpathQuery failed: %v\", err)\n\t\t}\n\t}\n\n\tif s.config.PrettyName != \"\" {","sourceCodeStart":124,"sourceCodeEnd":160,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/wineventlog/config_windows.go#L124-L160","documentation":"The wineventlog source lets you subscribe either by a named Windows event channel ('event_channel') or by a raw XPath query ('xpath_query'), but not both simultaneously. UnmarshalConfig rejects configs that set both keys.","triggerScenarios":"Acquisition YAML (or DSN) containing both event_channel and xpath_query keys with non-empty values.","commonSituations":"Merging two example configs together; adding an xpath filter while leaving the channel key present; incremental edits over time accumulating both options.","solutions":["Delete the xpath_query key and keep event_channel (e.g. event_channel: Security)","Or delete event_channel and supply a full xpath_query if custom filtering is needed","Keep only one of the two keys in the acquisition config"],"exampleFix":"// before\nevent_channel: Security\nxpath_query: '*[System[(Level=2)]]'\n// after\nevent_channel: Security","handlingStrategy":"validation","validationCode":"if cfg[\"event_channel\"] != \"\" && cfg[\"xpath_query\"] != \"\" { return errors.New(\"set only one of event_channel or xpath_query\") }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["When adding custom xpath filters, remove the event_channel key","Review full acquisition file after merging configs","Use one config source of truth per datasource"],"tags":["wineventlog","windows","configuration"],"backgroundTag":"mutually-exclusive-options","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}