Windows error 15014 (ERROR_EVT_FILTER

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: the Event Log XPath applies a scope-changing step to an expression that is already scoped.

Previous	Next
ERROR_EVT_NON_VALIDATING_MSXML	ERROR_EVT_FILTER_NOTELTSET

ERROR_EVT_FILTER_ALREADYSCOPED

The filter attempts an invalid second change of XPath scope

Windows Event Log implements a constrained location-path evaluator. A change-of-scope operation is valid only when the preceding expression produces a node set suitable for that step and has not already been consumed by another scope change. Nesting scope operations as though the engine implemented full XPath can trigger this parser-specific error.

Rewrite the selector around the Event XML hierarchy instead of stacking scope changes. Start from the event node, then walk child elements and place comparisons in predicates. Because Windows supports only the child and attribute axes and does not support general node-set processing, validate the expression with the Event Log API rather than a browser XPath console.

What to inspect

Reduce the path to one scope transition at a time.
Use Event schema element paths and predicates instead of general XPath constructs.
Call EvtGetExtendedStatus to locate the rejected expression.

References

Looking for a different code? Search another status or error code.