What does Windows error code 15018 (ERROR_EVT_FILTER_INVTYPE) mean?

ERROR_EVT_FILTER_INVTYPE

The query requests an unsupported filter data type

Event records contain strings, integers, Boolean values, timestamps, GUIDs, SIDs and other rendered forms, but the Event Log XPath subset does not expose unrestricted XPath type conversion. A literal or operation can therefore be syntactically valid yet unsupported for the selected event field or function.

Inspect the raw event XML and compare using the representation exposed there. Avoid forcing values through unsupported string or node-set functions. Numeric masks should use Band, and relative time tests should use timediff with FILETIME-based event timestamps as documented. If a provider places complex data under UserData or EventData, filter on a supported leaf value.

What to inspect

• Check the rendered XML type and representation of the target field.
• Remove unsupported conversion functions.
• Test a direct equality predicate before adding arithmetic or functions.

References

• Microsoft: Event Log XPath subset and result behavior
• W3C: XPath 1.0 Recommendation
• Microsoft: event data templates