Hello team, I'm trying to ingest Windows Logs to O2 and apply event filtering. But method mentioned in Docs does not work. After adding

xpath_query

to my config the service fails to restart. Have anyone faced similar issues?

@BlueNinja Hey! I haven't run into this myself. Can you share your

windows_event_log

receiver config (especially the

xpath_query

part) along with the error you're getting when the collector restarts? Also, which OpenObserve version and OpenTelemetry Collector version are you using? That should help us narrow down whether it's the XPath syntax, the collector config, or something else.

Hi, @Simran(OpenObserve) Here is my config

receivers:
  hostmetrics:
    collection_interval: 30s
    scrapers:
      cpu:
      disk:
      filesystem:
      load:
      memory:
      network:
      paging:
      processes:
      # process: # a bug in the process scraper causes the collector to throw errors so disabling it for now

  windowsperfcounters/memory:
    metrics:
      bytes.committed:
        description: the number of bytes committed to memory
        unit: By
        gauge:
    collection_interval: 30s
    perfcounters:
      - object: Memory
        counters:
          - name: Committed Bytes
            metric: bytes.committed

  windowsperfcounters/processor:
    collection_interval: 1m
    metrics:
      processor.time:
        description: active and idle time of the processor
        unit: "%"
        gauge:
    perfcounters:
      - object: "Processor"
        instances: "*"
        counters:
          - name: "% Processor Time"
            metric: processor.time
            attributes:
              state: active
      - object: "Processor"
        instances: [1, 2]
        counters:
          - name: "% Idle Time"
            metric: processor.time
            attributes:
              state: idle
  windowseventlog/application:
    channel: application
  windowseventlog/security:
    channel: security
    xpath_query: "*[System[(EventID=4624 or EventID=4688 or EventID=4663)]]"
  windowseventlog/setup:
    channel: setup
  windowseventlog/system:
    channel: system
  windowseventlog/sysmon:
    channel: Microsoft-Windows-Sysmon/Operational

processors:
  resourcedetection/system:
    detectors: ["system"]
    system:
      hostname_sources: ["os"]
  memory_limiter:
    check_interval: 1s
    limit_percentage: 75
    spike_limit_percentage: 15
  batch:
    send_batch_size: 10000
    timeout: 10s

extensions:
  zpages: {}
  memory_ballast:
    size_mib: 512

exporters:
  otlphttp/openobserve:
    endpoint: <http://192.168.200.22:5080/api/default/>
    headers:
      stream-name: windows
      Authorization: "Basic YWRtaW5AZXhhbXBsZS5jb206bzJvaV9WeURyWW12bTVBbFJXVkF2WHZCYkMxcEVFNUdDbFpKQQ=="

service:
  extensions: [zpages, memory_ballast]
  pipelines:
    metrics:
      receivers: [windowsperfcounters/processor, windowsperfcounters/memory, hostmetrics]
      processors: [resourcedetection/system, memory_limiter, batch]
      exporters: [otlphttp/openobserve]
    logs:
      receivers: [windowseventlog/application,windowseventlog/security,windowseventlog/setup,windowseventlog/system,windowseventlog/sysmon]
      processors: [resourcedetection/system, memory_limiter, batch]
      exporters: [otlphttp/openobserve]

The error during service restart (

EventID: 7023

):

The otel-collector service terminated with the following error:
An exception occurred in the service when handling the control request.

I use

v0.92.0-rc1

OpenObserve and OpenObserve Agent v0.156.0

Also does the log flow works on removing the xpath query ?

Yes when I remove xpath query it works

okay, allow me sometime i will get back shortly

Are there any additional logs from the agent cause I havent seen in the install directory?