crowdsecurity/crowdsec · error

event_channel and xpath_query are mutually exclusive

Error message

event_channel and xpath_query are mutually exclusive

What it means

The wineventlog source lets you subscribe either by a named Windows event channel ('event_channel') or by a raw XPath query ('xpath_query'), but not both simultaneously. UnmarshalConfig rejects configs that set both keys.

Source

Thrown at pkg/acquisition/modules/wineventlog/config_windows.go:142

	}
	config.Query, err = windows.UTF16PtrFromString(query)
	if err != nil {
		return &config, fmt.Errorf("windows.UTF16PtrFromString failed: %v", err)
	}

	return &config, nil
}

func (s *Source) UnmarshalConfig(yamlConfig []byte) error {
	s.config = Configuration{}

	err := yaml.UnmarshalWithOptions(yamlConfig, &s.config, yaml.Strict())
	if err != nil {
		return fmt.Errorf("cannot parse wineventlog configuration: %s", yaml.FormatError(err, false, false))
	}

	if s.config.EventChannel != "" && s.config.XPathQuery != "" {
		return errors.New("event_channel and xpath_query are mutually exclusive")
	}

	if s.config.EventChannel == "" && s.config.XPathQuery == "" {
		return errors.New("event_channel or xpath_query must be set")
	}

	s.config.Mode = configuration.TAIL_MODE

	if s.config.XPathQuery != "" {
		s.query = s.config.XPathQuery
	} else {
		s.query, err = s.buildXpathQuery()
		if err != nil {
			return fmt.Errorf("buildXpathQuery failed: %v", err)
		}
	}

	if s.config.PrettyName != "" {

View on GitHub (pinned to 909b515798)

Solutions

1. Delete the xpath_query key and keep event_channel (e.g. event_channel: Security)
2. Or delete event_channel and supply a full xpath_query if custom filtering is needed
3. Keep only one of the two keys in the acquisition config

Example fix

// before
event_channel: Security
xpath_query: '*[System[(Level=2)]]'
// after
event_channel: Security

if cfg["event_channel"] != "" && cfg["xpath_query"] != "" { return errors.New("set only one of event_channel or xpath_query") }

When it happens

Trigger: Acquisition YAML (or DSN) containing both event_channel and xpath_query keys with non-empty values.

Common situations: Merging two example configs together; adding an xpath filter while leaving the channel key present; incremental edits over time accumulating both options.

Related errors

• invalid log level
• event_channel or xpath_query must be set
• empty wineventlog:// DSN
• too many arguments in DSN
• log_level must be a single value

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/ef7e594293ad96c2. Report an issue: GitHub.