crowdsecurity/crowdsec · error

event_channel or xpath_query must be set

Error message

event_channel or xpath_query must be set

What it means

The wineventlog acquisition source requires exactly one way to select events: either an explicit channel name (event_channel) or a custom XPath filter (xpath_query). At config unmarshal time, if both are empty the source has no event selection, so UnmarshalConfig rejects the configuration.

Source

Thrown at pkg/acquisition/modules/wineventlog/config_windows.go:146

	}

	return &config, nil
}

func (s *Source) UnmarshalConfig(yamlConfig []byte) error {
	s.config = Configuration{}

	err := yaml.UnmarshalWithOptions(yamlConfig, &s.config, yaml.Strict())
	if err != nil {
		return fmt.Errorf("cannot parse wineventlog configuration: %s", yaml.FormatError(err, false, false))
	}

	if s.config.EventChannel != "" && s.config.XPathQuery != "" {
		return errors.New("event_channel and xpath_query are mutually exclusive")
	}

	if s.config.EventChannel == "" && s.config.XPathQuery == "" {
		return errors.New("event_channel or xpath_query must be set")
	}

	s.config.Mode = configuration.TAIL_MODE

	if s.config.XPathQuery != "" {
		s.query = s.config.XPathQuery
	} else {
		s.query, err = s.buildXpathQuery()
		if err != nil {
			return fmt.Errorf("buildXpathQuery failed: %v", err)
		}
	}

	if s.config.PrettyName != "" {
		s.name = s.config.PrettyName
	} else {
		s.name = s.query
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Add 'event_channel: <ChannelName>' (e.g. Security, System, Application) to the wineventlog source config
2. Or add 'xpath_query: <XPath expression>' for custom event filtering
3. Check for key typos and correct indentation so the keys land under the right source stanza

Example fix

// before
source: wineventlog
// after
source: wineventlog
event_channel: Security

// Go: validate wineventlog config before writing/acquiring
if cfg.EventChannel == "" && cfg.XPathQuery == "" {
    return fmt.Errorf("wineventlog source needs event_channel or xpath_query")
}
if cfg.EventChannel != "" && cfg.XPathQuery != "" {
    return fmt.Errorf("event_channel and xpath_query are mutually exclusive")
}

When it happens

Trigger: Loading a YAML acquisition file where a wineventlog source stanza omits both 'event_channel' and 'xpath_query' keys, or both are set to empty strings after config parsing.

Common situations: Copy-pasting an acquisition template and deleting the channel line without adding an xpath_query; building config programmatically and forgetting to set either field; typos like 'event-channel' or 'xpathquery' so neither recognized key is populated.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• empty wineventlog:// DSN
• too many arguments in DSN
• log_level must be a single value
• event_level must be a single value
• windows event log acquisition is only supported on Windows

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/b1b062ef7525859d. Report an issue: GitHub.