crowdsecurity/crowdsec · error

buildXpathQuery failed: %w

Error message

buildXpathQuery failed: %w

What it means

In ConfigureByDSN, after DSN parameters are applied, the source builds the XPath query from the configured event IDs/levels via buildXpathQuery (custom XPath via DSN is not yet supported — see the FIXME). This error wraps any failure of that builder, meaning the event_id/event_level filters could not be converted into a valid XPath query for the Windows Event Log API.

Source

Thrown at pkg/acquisition/modules/wineventlog/config_windows.go:247

						return fmt.Errorf("failed to parse event_id: %s", err)
					}
					s.config.EventIDs = append(s.config.EventIDs, evtid)
				}
			case "event_level":
				if len(value) != 1 {
					return errors.New("event_level must be a single value")
				}
				s.config.EventLevel = value[0]
			}
		}
	}

	var err error

	// FIXME: handle custom xpath query
	s.query, err = s.buildXpathQuery()
	if err != nil {
		return fmt.Errorf("buildXpathQuery failed: %w", err)
	}

	s.logger.Debugf("query: %s\n", s.query)

	s.evtConfig, err = s.generateConfig(s.query, false)
	if err != nil {
		return fmt.Errorf("generateConfig failed: %w", err)
	}

	return nil
}

View on GitHub (pinned to 909b515798)

Solutions

1. Check the wrapped inner error to identify which filter value failed.
2. Confirm the DSN's channel/file segment is present and correct, e.g. `wineventlog://Security?event_id=4625`.
3. Use standard event_level values (critical, error, warning, information, verbose).
4. If you need custom XPath filtering, use a YAML acquisition file with xpath_query instead of a DSN (DSN custom XPath is unimplemented).

Example fix

// before
wineventlog://?event_level=err
// after
wineventlog://Security?event_level=error

if channel == "" && eventFile == "" {
	return errors.New("DSN must specify a channel or event file")
}
if !slices.Contains(levels, "critical") && !knownLevel(levels) { /* validate before calling */ }

if err := src.ConfigureByDSN(ctx, dsn, labels, logger, uuid); err != nil {
	if strings.Contains(err.Error(), "buildXpathQuery") {
		return fmt.Errorf("unsupported filters in DSN %q; use xpath_query in YAML config", dsn)
	}
	return err
}

When it happens

Trigger: Calling ConfigureByDSN with a DSN whose event_id or event_level values, once parsed into Configuration, produce a filter buildXpathQuery cannot represent — e.g. an empty channel with filters, or values the builder deems invalid.

Common situations: DSNs missing the channel segment (args[0] empty) while filters are set, event_level names the builder does not map to known levels, or very large event_id lists producing malformed XPath.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• empty wineventlog:// DSN
• too many arguments in DSN
• log_level must be a single value
• event_level must be a single value
• buildXpathQuery failed: %v

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/5cc05e7003244700. Report an issue: GitHub.