| Previous | Next |
| ERROR_EVT_CHANNEL_CANNOT_ACTIVATE | ERROR_EVT_MESSAGE_NOT_FOUND |
ERROR_EVT_FILTER_TOO_COMPLEX
The Event Log XPath expression is too complex
Windows Event Log deliberately limits filter complexity. Structured queries can contain multiple Select and Suppress expressions, while each XPath expression has its own expression-count and implementation limits. Deeply nested Boolean logic, many repeated conditions or generated exclusion lists can exceed those limits even when every individual operator is supported.
Split the logic into several selectors or several queries and merge results in the consumer. Use channel, provider, event ID, level and time predicates to reduce the result set early, then perform large membership tests outside the Event Log service. Do not merely add parentheses or convert the same expression to QueryList XML; that changes packaging, not the underlying evaluator complexity.
What to inspect
- Count generated conditions after all configuration expansion.
- Split large OR lists into multiple selectors or queries.
- Keep selective system predicates server-side and post-process the rest.
References
- Microsoft: structured Event Log query schema
- Microsoft: Event Log XPath subset and result behavior
- Microsoft: querying Windows events
Looking for a different code? Search another status or error code.