What does Windows error code 15021 (ERROR_EVT_FILTER_UNEXPECTEDTOKEN) mean?

 
Previous Next
ERROR_EVT_FILTER_UNSUPPORTEDOP ERROR_EVT_INVALID_OPERATION_OVER_ENABLED_DIRECT_CHANNEL

ERROR_EVT_FILTER_UNEXPECTEDTOKEN

The XPath parser encountered an unexpected token

An unexpected-token error usually means the individual character or keyword is recognized, but it appears where the parser expected a node name, operator, literal or closing delimiter. Configuration substitution can create this state by removing a value, duplicating an operator or injecting unescaped quote characters into an otherwise valid predicate.

Capture the final query exactly as passed to the API and obtain EvtGetExtendedStatus on the same thread. Inspect the token immediately before the reported location as well as the token itself; the earlier item may have left the parser in the wrong state. Parameterize application logic outside the XPath instead of concatenating unchecked text into selectors.

What to inspect

  • Inspect the fully expanded query, not only its template.
  • Check the token before the reported location for a missing operand or delimiter.
  • Escape or validate values before embedding them in XML and XPath.

References


Looking for a different code? Search another status or error code.