crowdsecurity/crowdsec · error

invalid log level

Error message

invalid log level

What it means

The wineventlog source maps a configured 'level' string to Windows event level IDs via logLevelToInt. Only CRITICAL/ERROR/WARNING/INFORMATION/VERBOSE are accepted; any other value returns 'invalid log level' while buildXpathQuery builds the event query.

Source

Thrown at pkg/acquisition/modules/wineventlog/config_windows.go:54

type Select struct {
	Path  string `xml:"Path,attr,omitempty"`
	Query string `xml:",chardata"`
}

func logLevelToInt(logLevel string) ([]string, error) {
	switch strings.ToUpper(logLevel) {
	case "CRITICAL":
		return []string{"1"}, nil
	case "ERROR":
		return []string{"2"}, nil
	case "WARNING":
		return []string{"3"}, nil
	case "INFORMATION":
		return []string{"0", "4"}, nil
	case "VERBOSE":
		return []string{"5"}, nil
	default:
		return nil, errors.New("invalid log level")
	}
}

func (s *Source) buildXpathQuery() (string, error) {
	var query string
	queryComponents := [][]string{}
	if s.config.EventIDs != nil {
		eventIds := []string{}
		for _, id := range s.config.EventIDs {
			eventIds = append(eventIds, fmt.Sprintf("EventID=%d", id))
		}
		queryComponents = append(queryComponents, eventIds)
	}
	if s.config.EventLevel != "" {
		levels, err := logLevelToInt(s.config.EventLevel)
		logLevels := []string{}
		if err != nil {
			return "", err

View on GitHub (pinned to 909b515798)

Solutions

1. Set level to one of: CRITICAL, ERROR, WARNING, INFORMATION, VERBOSE
2. Check the exact accepted values in the wineventlog docs/source (case matters)
3. Remove the level option to use the default filter if you don't need one

Example fix

// before
level: info
// after
level: INFORMATION

validLevels := map[string]bool{"CRITICAL":true,"ERROR":true,"WARNING":true,"INFORMATION":true,"VERBOSE":true}
if level != "" && !validLevels[level] { return fmt.Errorf("level %q not supported", level) }

When it happens

Trigger: UnmarshalConfig/DSN sets level to an unknown string (e.g. 'info', 'debug', 'critical' lowercase variants depending on accepted set, 'trace'), which buildXpathQuery cannot map.

Common situations: Typo in the level key; using generic 'info'/'debug' conventions instead of the Windows level names; copying config from another log source with different level vocabulary.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• event_channel and xpath_query are mutually exclusive
• event_channel or xpath_query must be set
• empty wineventlog:// DSN
• too many arguments in DSN
• log_level must be a single value

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/523fbbeee2b44f38. Report an issue: GitHub.