crowdsecurity/crowdsec · error

cannot parse wineventlog configuration: %s

Error message

cannot parse wineventlog configuration: %s

What it means

UnmarshalConfig parses the wineventlog acquisition YAML into the Configuration struct using yaml.Strict(), which rejects any unknown field. This error means the YAML could not be decoded — either due to syntax errors, wrong types, or unknown keys — and it embeds the formatted yaml error. Strict mode is used so typos in config keys fail fast rather than being silently ignored.

Source

Thrown at pkg/acquisition/modules/wineventlog/config_windows.go:138

		if err != nil {
			return &config, fmt.Errorf("windows.UTF16PtrFromString failed: %v", err)
		}
		config.Flags = wevtapi.EvtQueryFilePath | wevtapi.EvtQueryForwardDirection
	}
	config.Query, err = windows.UTF16PtrFromString(query)
	if err != nil {
		return &config, fmt.Errorf("windows.UTF16PtrFromString failed: %v", err)
	}

	return &config, nil
}

func (s *Source) UnmarshalConfig(yamlConfig []byte) error {
	s.config = Configuration{}

	err := yaml.UnmarshalWithOptions(yamlConfig, &s.config, yaml.Strict())
	if err != nil {
		return fmt.Errorf("cannot parse wineventlog configuration: %s", yaml.FormatError(err, false, false))
	}

	if s.config.EventChannel != "" && s.config.XPathQuery != "" {
		return errors.New("event_channel and xpath_query are mutually exclusive")
	}

	if s.config.EventChannel == "" && s.config.XPathQuery == "" {
		return errors.New("event_channel or xpath_query must be set")
	}

	s.config.Mode = configuration.TAIL_MODE

	if s.config.XPathQuery != "" {
		s.query = s.config.XPathQuery
	} else {
		s.query, err = s.buildXpathQuery()
		if err != nil {
			return fmt.Errorf("buildXpathQuery failed: %v", err)

View on GitHub (pinned to 909b515798)

Solutions

1. Read the wrapped message (`yaml.FormatError(...)`) — it names the exact line/key that failed — and fix that key or value.
2. Validate YAML syntax with `yamllint` or an online parser; fix indentation and remove tabs.
3. Compare your keys against the documented wineventlog fields: event_channel, xpath_query, event_ids, event_levels, event_file, log_level, labels, etc. Use snake_case exactly.
4. Remove unknown/obsolete keys — strict parsing rejects anything not in the Configuration struct.

Example fix

// before (acquis.yaml)
source: wineventlog
Event_Channel: System
xpath_query: '*'
// after
source: wineventlog
event_channel: System
xpath_query: '*'

if err := yaml.UnmarshalWithOptions(data, &map[string]any{}, yaml.Strict()); err != nil { /* surface to user before deployment */ }
// or lint at CI: yamllint acquis.d/*.yaml

if err := src.UnmarshalConfig(yamlConfig); err != nil {
	return fmt.Errorf("invalid wineventlog acquisition config: %w", err)
}

When it happens

Trigger: Calling UnmarshalConfig (invoked when loading acquisition files) with YAML that has invalid syntax, a key not present in the Configuration struct (e.g. `xpath-querry`), or a value whose type mismatches the struct field (e.g. `event_id: [abc]`).

Common situations: Typos in acquisition.yaml keys, indentation mistakes, using camelCase instead of snake_case keys, copying config from an older/newer crowdsec version with renamed fields, or tabs instead of spaces in YAML.

Related errors

• event_channel or xpath_query must be set
• empty file
• while parsing DockerAcquisition configuration: %s
• cannot parse FileAcquisition configuration: %s
• cannot parse: %s

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/7e19fd650b806934. Report an issue: GitHub.