| Previous | Next |
| ERROR_EVT_FILTER_ALREADYSCOPED | ERROR_EVT_FILTER_INVARG |
ERROR_EVT_FILTER_NOTELTSET
The filter continues a path from a scalar instead of event elements
A Windows Event Log selector must navigate event XML elements. Once an expression has produced an attribute, number, string or Boolean result, another path step cannot be applied as though that result were a collection of elements. This commonly appears when a comparison or attribute selection is placed too early in the location path.
Move navigation steps before the predicate that converts the expression to a scalar truth value. Keep Select paths rooted at the event node and test leaf values inside brackets. The Windows subset does not support general XPath node-set behavior, so an expression that another XPath engine accepts can still need restructuring for Event Log.
What to inspect
- Identify the step immediately before the failing path separator.
- Navigate to the element first, then compare its value in a predicate.
- Test the rewritten selector with EvtQuery and extended status enabled.
References
- Microsoft: Event Log XPath subset and result behavior
- Microsoft: querying Windows events
- W3C: XPath 1.0 Recommendation
Looking for a different code? Search another status or error code.