crowdsecurity/crowdsec · error

buildXpathQuery failed: %v

Error message

buildXpathQuery failed: %v

What it means

When xpath_query is not set in the YAML config, UnmarshalConfig calls buildXpathQuery to synthesize an XPath query from the event_ids/event_levels fields. This error wraps any failure from that builder. It means the configured event ID/level filters could not be turned into a valid XPath expression.

Source

Thrown at pkg/acquisition/modules/wineventlog/config_windows.go:156

		return fmt.Errorf("cannot parse wineventlog configuration: %s", yaml.FormatError(err, false, false))
	}

	if s.config.EventChannel != "" && s.config.XPathQuery != "" {
		return errors.New("event_channel and xpath_query are mutually exclusive")
	}

	if s.config.EventChannel == "" && s.config.XPathQuery == "" {
		return errors.New("event_channel or xpath_query must be set")
	}

	s.config.Mode = configuration.TAIL_MODE

	if s.config.XPathQuery != "" {
		s.query = s.config.XPathQuery
	} else {
		s.query, err = s.buildXpathQuery()
		if err != nil {
			return fmt.Errorf("buildXpathQuery failed: %v", err)
		}
	}

	if s.config.PrettyName != "" {
		s.name = s.config.PrettyName
	} else {
		s.name = s.query
	}

	return nil
}

func (s *Source) Configure(ctx context.Context, yamlConfig []byte, logger *log.Entry, metricsLevel metrics.AcquisitionMetricsLevel) error {
	s.logger = logger
	s.metricsLevel = metricsLevel

	err := s.UnmarshalConfig(yamlConfig)
	if err != nil {

View on GitHub (pinned to 909b515798)

Solutions

1. Read the wrapped inner error from buildXpathQuery to see which filter value is rejected.
2. Use canonical Windows event level names/numbers (Critical, Error, Warning, Information, Verbose) in event_levels.
3. Simplify: set an explicit `xpath_query: '*[*]'` or a well-formed XPath instead of relying on the builder.
4. Test the generated XPath in Windows Event Viewer's 'Filter Current Log' XML tab before deploying.

Example fix

// before
source: wineventlog
event_channel: System
event_levels: [warn, fatal]
// after
source: wineventlog
event_channel: System
event_levels: [warning, critical]

for _, lvl := range cfg.EventLevels {
	if !slices.Contains([]string{"critical","error","warning","information","verbose"}, strings.ToLower(lvl)) {
		return fmt.Errorf("unknown event level %q", lvl)
	}
}

if err := src.UnmarshalConfig(data); err != nil {
	if strings.Contains(err.Error(), "buildXpathQuery") {
		// fall back to a permissive query
		cfg.XPathQuery = "*[EventData]"
		return src.UnmarshalConfig(data)
	}
	return err
}

When it happens

Trigger: Omitting xpath_query while providing event_ids/event_levels values that buildXpathQuery cannot represent — e.g. invalid level names or an empty/unparseable filter set — causing the internal builder to return an error.

Common situations: Users writing `event_levels: [warning, fatal]` with level names the builder doesn't recognize, malformed event_ids entries in the YAML config, or combining fields in a way the builder rejects.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• event_channel or xpath_query must be set
• windows.UTF16PtrFromString failed: %v
• cannot parse wineventlog configuration: %s
• invalid DSN %s for wineventlog source, must start with winev
• buildXpathQuery failed: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/8b5ba99af38109c7. Report an issue: GitHub.