What does Windows error code 15020 (ERROR_EVT_FILTER_UNSUPPORTEDOP) mean?

ERROR_EVT_FILTER_UNSUPPORTEDOP

The filter operator is outside the supported Event Log subset

Windows Event Log supports selected comparison and Boolean operators plus a small set of functions. Full XPath 1.0 contains additional axes, functions and node-set operations that the Event Log engine intentionally omits. A query may therefore be valid according to the W3C language but still fail with this implementation-specific code.

Replace the operation with supported child or attribute navigation, comparisons, AND/OR grouping, Band for bit masks or timediff for time windows. For logic that cannot be expressed efficiently, broaden the server-side query and perform the final test in the consumer. Splitting a structured query into several selectors is preferable to relying on an unsupported operator.

What to inspect

• Identify the exact operator from extended status.
• Rewrite using documented Event Log operators and functions.
• Move irreducible post-processing into the consuming application.

References

• Microsoft: Event Log XPath subset and result behavior
• W3C: XPath 1.0 Recommendation
• Microsoft: structured Event Log query schema