Windows eventlog scraping skips events silently

Grafana Alloy
1

I am using loki.source.windowsevent to process windows eventlogs (application specifically) and for unknown reasons it skips certain events.

How would i troubleshoot this? Enabling debug and livedebugging does not give any hint at all why alloy does skips certain events.

2

请提供你的alloy代码及win eventlog 截图

3

Troubleshooting steps and details as follows:

  1. This is my config.alloy:
logging {
	level = "debug"
}

loki.source.windowsevent "application" {
	eventlog_name          = "Application"
	use_incoming_timestamp = true
	exclude_event_message  = false
	forward_to             = [loki.echo.example.receiver]
	xpath_query 		   = "*[System[(EventRecordID=547333)]]"
}

loki.echo "example" { }

livedebugging {
	enabled = false
}
  1. Before running alloy i set the content of

C:\ProgramData\GrafanaLabs\Alloy\data\loki.source.windowsevent.application\bookmark.xml to:

<BookmarkList>
  <Bookmark Channel='Application' RecordId='547832' IsCurrent='true'/>
</BookmarkList>
  1. Run alloy from powershell:
& "C:\Program Files\GrafanaLabs\Alloy\alloy-windows-amd64.exe" run "C:\Program Files\GrafanaLabs\Alloy\config.alloy" --storage.path=C:\ProgramData\GrafanaLabs\Alloy\data --disable-reporting
  1. stdout result
PS C:\Program Files\fluent-bit> & "C:\Program Files\GrafanaLabs\Alloy\alloy-windows-amd64.exe" run "C:\Program Files\GrafanaLabs\Alloy\config.alloy" --storage.path=C:\ProgramData\GrafanaLabs\Alloy\data --disable-reporting
ts=2026-04-16T04:49:56.4442671Z level=info boringcrypto_enabled=false
ts=2026-04-16T04:49:56.4442671Z level=info msg="no peer discovery configured: both join and discover peers are empty" service=cluster
ts=2026-04-16T04:49:56.4442671Z level=debug msg="Running alloy controller" controller_id=""
ts=2026-04-16T04:49:56.4442671Z level=info msg="starting complete graph evaluation" controller_path=/ controller_id="" trace_id=933f9bb9c86dc8250c8a74801f41df89ts=2026-04-16T04:49:56.4442671Z level=info msg="finished node evaluation" controller_path=/ controller_id="" trace_id=933f9bb9c86dc8250c8a74801f41df89 node_id=tracing duration=0s
ts=2026-04-16T04:49:56.4442671Z level=info msg="finished node evaluation" controller_path=/ controller_id="" trace_id=933f9bb9c86dc8250c8a74801f41df89 node_id=logging duration=0s
ts=2026-04-16T04:49:56.4442671Z level=info msg="finished node evaluation" controller_path=/ controller_id="" trace_id=933f9bb9c86dc8250c8a74801f41df89 node_id=livedebugging duration=0s
ts=2026-04-16T04:49:56.4442671Z level=info msg="finished node evaluation" controller_path=/ controller_id="" trace_id=933f9bb9c86dc8250c8a74801f41df89 node_id=remotecfg duration=0s
ts=2026-04-16T04:49:56.4442671Z level=info msg="applying non-TLS config to HTTP server" service=http
ts=2026-04-16T04:49:56.4442671Z level=info msg="finished node evaluation" controller_path=/ controller_id="" trace_id=933f9bb9c86dc8250c8a74801f41df89 node_id=http duration=0s
ts=2026-04-16T04:49:56.4442671Z level=info msg="finished node evaluation" controller_path=/ controller_id="" trace_id=933f9bb9c86dc8250c8a74801f41df89 node_id=ui duration=0s
ts=2026-04-16T04:49:56.4442671Z level=info msg="finished node evaluation" controller_path=/ controller_id="" trace_id=933f9bb9c86dc8250c8a74801f41df89 node_id=cluster duration=0s
ts=2026-04-16T04:49:56.4482787Z level=info msg="finished node evaluation" controller_path=/ controller_id="" trace_id=933f9bb9c86dc8250c8a74801f41df89 node_id=otel duration=0s
ts=2026-04-16T04:49:56.4482787Z level=info msg="finished node evaluation" controller_path=/ controller_id="" trace_id=933f9bb9c86dc8250c8a74801f41df89 node_id=labelstore duration=0s
ts=2026-04-16T04:49:56.4482787Z level=info msg="finished node evaluation" controller_path=/ controller_id="" trace_id=933f9bb9c86dc8250c8a74801f41df89 node_id=loki.echo.example duration=0s
ts=2026-04-16T04:49:56.4482787Z level=debug msg="Subcribed with handle id" component_path=/ component_id=loki.source.windowsevent.application id=2
ts=2026-04-16T04:49:56.4482787Z level=info msg="finished node evaluation" controller_path=/ controller_id="" trace_id=933f9bb9c86dc8250c8a74801f41df89 node_id=loki.source.windowsevent.application duration=0s
ts=2026-04-16T04:49:56.4482787Z level=info msg="finished complete graph evaluation" controller_path=/ controller_id="" trace_id=933f9bb9c86dc8250c8a74801f41df89 duration=4.0116ms
ts=2026-04-16T04:49:56.4482787Z level=debug msg="changing node state" service=cluster from=viewer to=participant
ts=2026-04-16T04:49:56.4482787Z level=info msg="scheduling loaded components and services" controller_id=""
ts=2026-04-16T04:49:56.4525026Z level=debug msg="Starting task" controller_id="" taskID=livedebugging id=livedebugging
ts=2026-04-16T04:49:56.4525026Z level=debug msg="Starting task" controller_id="" taskID=remotecfg id=remotecfg
ts=2026-04-16T04:49:56.4535032Z level=debug msg="Starting task" controller_id="" taskID=http id=http
ts=2026-04-16T04:49:56.4525026Z level=debug msg="Starting task" controller_id="" taskID=otel id=otel
ts=2026-04-16T04:49:56.4482787Z level=debug msg="finished node evaluation" controller_path=/ controller_id="" node_id=loki.source.windowsevent.application duration=0s
ts=2026-04-16T04:49:56.4525026Z level=debug msg="Starting task" controller_id="" taskID=loki.echo.example id=loki.echo.example
ts=2026-04-16T04:49:56.4525026Z level=debug msg="Starting task" controller_id="" taskID=labelstore id=labelstore
ts=2026-04-16T04:49:56.4535032Z level=info msg="failed to register collector with remote server" service=remotecfg id=bfef4079-f719-4197-8d7f-e8ea03cf3230 name="" err="noop client"
ts=2026-04-16T04:49:56.4535032Z level=debug msg="Starting task" controller_id="" taskID=ui id=ui
ts=2026-04-16T04:49:56.4535032Z level=debug msg="Starting task" controller_id="" taskID=loki.source.windowsevent.application id=loki.source.windowsevent.application
ts=2026-04-16T04:49:56.4545098Z level=debug msg="Running alloy controller" controller_id=remotecfg
ts=2026-04-16T04:49:56.4545098Z level=debug msg="Starting task" controller_id="" taskID=cluster id=cluster
ts=2026-04-16T04:49:56.4555028Z level=info msg="starting cluster node" service=cluster peers_count=0 peers="" advertise_addr=127.0.0.1:12345 minimum_cluster_size=0 minimum_size_wait_timeout=0s
ts=2026-04-16T04:49:56.4555028Z level=info msg="peers changed" service=cluster peers_count=1 min_cluster_size=0 peers=XXXX
ts=2026-04-16T04:49:56.4565037Z level=info msg="now listening for http traffic" service=http addr=127.0.0.1:12345
  1. Running the same procedure with xpath query set to record id 547828 gives me the expected result
ts=2026-04-16T04:58:30.108618Z level=debug msg="Starting task" controller_id="" taskID=remotecfg id=remotecfg
ts=2026-04-16T04:58:30.1068923Z level=debug msg="finished node evaluation" controller_path=/ controller_id="" node_id=loki.source.windowsevent.application duration=0s
ts=2026-04-16T04:58:30.1078145Z level=debug msg="Starting task" controller_id="" taskID=labelstore id=labelstore
ts=2026-04-16T04:58:30.1083287Z level=debug msg="Starting task" controller_id="" taskID=loki.echo.example id=loki.echo.example
ts=2026-04-16T04:58:30.1093091Z level=debug msg="Starting task" controller_id="" taskID=loki.source.windowsevent.application id=loki.source.windowsevent.application

ts=2026-04-16T04:58:30.1103806Z level=info component_path=/ component_id=loki.echo.example receiver=loki.echo.example entry="{\"source\":\"VSS\",\"channel\":\"Application\",\"computer\":\"XXX\",\"event_id\":8224,\"level\":4,\"levelText\":\"Information\",\"opCodeText\":\"Info\",\"keywords\":\"Classic\",\"timeCreated\":\"2026-04-15T06:15:47.0207912Z\",\"eventRecordID\":547828,\"event_data\":\"XXX",\"message\":\"The VSS service is shutting down due to idle timeout. \"}" entry_timestamp=2026-04-15T06:15:47.020Z labels="{channel=\"Application\", computer=\"XXX\"}" structured_metadata={}

ts=2026-04-16T04:58:30.108618Z level=debug msg="Starting task" controller_id="" taskID=http id=http
ts=2026-04-16T04:58:30.1093091Z level=info msg="failed to register collector with remote server" service=remotecfg id=9309a166-8b3e-40a1-aa2c-072c5427699c name="" err="noop client"
ts=2026-04-16T04:58:30.1139038Z level=debug msg="Running alloy controller" controller_id=remotecfg
ts=2026-04-16T04:58:30.1131222Z level=debug msg="Starting task" controller_id="" taskID=cluster id=cluster
ts=2026-04-16T04:58:30.1144812Z level=debug msg="Starting task" controller_id="" taskID=ui id=ui
ts=2026-04-16T04:58:30.1144812Z level=info msg="starting cluster node" service=cluster peers_count=0 peers="" advertise_addr=127.0.0.1:12345 minimum_cluster_size=0 minimum_size_wait_timeout=0s
ts=2026-04-16T04:58:30.115833Z level=info msg="now listening for http traffic" service=http addr=127.0.0.1:12345
ts=2026-04-16T04:58:30.1163626Z level=info msg="peers changed" service=cluster peers_count=1 min_cluster_size=0 peers=XXX
  1. This is the problematic event received via powershell:
Get-EventLog -LogName Application | Where-Object {$_.Index -eq 547333} |fl

anonymized:

Index              : 547333
EntryType          : Warning
InstanceId         : 712
Message            : The description for Event ID '712' in Source 'MicrosoftDynamicsNavServer$INSTANCENAMEREMOVED' cannot be found.  The local computer may not 
                     have the necessary registry information or message DLL files to display the message, or you may not have permission to access them.  The   
                     following information is part of the event:'Server instance: INSTANCENAMEREMOVED
                     Category: Runtime
                     ClientSessionId: 267253d0-65cd-49d1-a056-932574a1c5da
                     ClientActivityId: 14a9c0b0-7a31-28e7-046e-8864cc9aeb34
                     ServerSessionUniqueId: 454b7f9d-f789-491f-8c69-2137e5528890
                     ServerActivityId: 1238b3fb-cf55-4763-a432-f3f07ef3b65d
                     EventTime: 04/13/2026 12:11:51
                     Message (NavFilterException): Sending exception to client. Session terminating: False
                     ParentException: NavFilterException
                     Der Filter '<redacted>' ist für das Feld 'Herausgeber' der Tabelle 'Veröffentlichte Anwendung' nicht gültig. <redacted>
                     ExceptionStackTrace:
                        at Microsoft.Dynamics.Nav.Runtime.NavRecord.SetFilter(NCLMetaField metaField, NavFilter filter)
                        at Microsoft.Dynamics.Nav.Runtime.NavRecord.SetTableViewFilters(NavFilterGroup[] filterGroups, Predicate`1 condition)
                        at Microsoft.Dynamics.Nav.Service.NSDataSetState.ApplyToRecordWithoutPositioning(NavRecordState state, NsDataAccess recDataAccess)      
                        at Microsoft.Dynamics.Nav.Service.NSPage.<GetPageDataAsync>b__8_0(NsDataAccess recDataAccess)
                        at Microsoft.Dynamics.Nav.Service.NsFormDataAccess.RunWithFormDataAccessAsync[T](ITreeObject parent, NavForm form, Func`2 func)
                        at Microsoft.Dynamics.Nav.Service.NsDataAccess.RunWithDataAccessAsync[T](ITreeObject parent, NavRecordState state, Boolean
                     instantiateNewForm, Guid parentFormHandle, String parentControlName, Func`2 func)
                        at Microsoft.Dynamics.Nav.Service.NSPage.GetPageAsync(NavSession session)
                        at Microsoft.Dynamics.Nav.Service.AspNetCore.ClientService.ServiceOperationPipelineHelper.CallWithHandlingTargetInvocationException[T](
                     Func`1 asyncFunc)
                        at Microsoft.Dynamics.Nav.Service.ServiceOperationPipeline.StartSamplingProfilingCombinator[T](ServiceOperationContext context,
                     ServiceOperation`1 innerOperation)
                        at Microsoft.Dynamics.Nav.Service.ServiceOperationPipeline.AddSessionToThreadSchedulerCombinator[T](ServiceOperationContext context,    
                     ServiceOperation`1 innerOperation)
                        at Microsoft.Dynamics.Nav.Service.ServiceOperationPipeline.RunInTransactionCombinator[T](ServiceOperationContext context,
                     ServiceOperation`1 innerOperation)
                        at Microsoft.Dynamics.Nav.Service.ServiceOperationPipeline.TransientErrorRetryCombinator[T](ServiceOperationContext context,
                     ServiceOperation`1 innerOperation)
                        at Microsoft.Dynamics.Nav.Service.ServiceOperationPipeline.ErrorMappingCombinator[T](ServiceOperationContext context,
                     ServiceOperation`1 innerOperation, Boolean useCoreWcfFaultException)
                     InnerException:
                     ParentException: NavCSideException
                     Error Code:18023434
                     Der Filter '<redacted>' ist für das Feld 'Herausgeber' der Tabelle 'Veröffentlichte Anwendung' nicht gültig. <redacted>
                     ExceptionStackTrace:
                        at Microsoft.Dynamics.Nav.Runtime.RecordImplementationHelper.GetInvalidFilterException(NavRecord parentRecord, NCLMetaField metaField,  
                     String expression, Exception innerException)
                        at Microsoft.Dynamics.Nav.Runtime.RecordImplementation.SetFieldFilter(NCLMetaField metaField, String expression, String
                     userTypedExpression, NavValue[] values)
                        at Microsoft.Dynamics.Nav.Runtime.NavRecord.SetFilter(NCLMetaField metaField, NavFilter filter)
                     InnerException:
                     RootException: NavInvalidFilterExpressionException
                     Fehler beim Interpretieren des Filters: „<redacted>“ wurde nicht erwartet.

                     Weitere Informationen finden Sie unter https://go.microsoft.com/fwlink/?linkid=2158058.
                     ExceptionStackTrace:
                        at Microsoft.Dynamics.Nav.Runtime.FilterExpressionParser.Parse(Boolean useOnlyVariableResolver, DataError dataError)
                        at Microsoft.Dynamics.Nav.Runtime.FilterExpressionParser.ParseWithoutBalancing(String expression, FilterExpressionContext
                     expressionContext, Func`3 customVariableResolver, Int32 unknownVariableResolverDepth, NavValue[] values, Int32& expressionLeafCount,       
                     Boolean& hasVariables, Boolean cultureInvariant, DataError dataError)
                        at Microsoft.Dynamics.Nav.Runtime.RecordImplementation.SetFieldFilter(NCLMetaField metaField, String expression, String
                     userTypedExpression, NavValue[] values)
                     CallerStackTrace:
                        at Microsoft.Dynamics.Nav.Service.ServiceExceptionHandling.MapServiceOperationException(Exception e, NavSession session, Boolean        
                     useCoreWcfFaultException)
                        at Microsoft.Dynamics.Nav.Service.ServiceOperationPipeline.ErrorMappingCombinator[T](ServiceOperationContext context,
                     ServiceOperation`1 innerOperation, Boolean useCoreWcfFaultException)
                        at _Diag_.Net._Async_Internals_()
                        at Microsoft.Dynamics.Nav.Service.ServiceOperationPipeline.ErrorMappingCombinator[T](ServiceOperationContext context,
                     ServiceOperation`1 innerOperation, Boolean useCoreWcfFaultException)
                        at Microsoft.Dynamics.Nav.Service.ServiceOperationPipeline.PartnerTelemetryPermissionErrorCombinator[T](ServiceOperationContext
                     context, ServiceOperation`1 innerOperation)
                        at _Diag_.Net._Async_Internals_()
                        at Microsoft.Dynamics.Nav.Service.ServiceOperationPipeline.PartnerTelemetryPermissionErrorCombinator[T](ServiceOperationContext
                     context, ServiceOperation`1 innerOperation)
                        at Microsoft.Dynamics.Nav.Service.ServiceOperationPipeline.PushPopCombinator[T](ServiceOperationContext context, ServiceOperation`1     
                     innerOperation, Boolean useCoreWcfFaultException)
                        at _Diag_.Net._Async_Internals_()
                        at Microsoft.Dynamics.Nav.Service.ServiceOperationPipeline.PushPopCombinator[T](ServiceOperationContext context, ServiceOperation`1     
                     innerOperation, Boolean useCoreWcfFaultException)
                        at Microsoft.Dynamics.Nav.Service.ServiceOperationTracer.TraceScopeCombinator[T](Category telemetryCategory, ServiceOperationContext    
                     context, ServiceOperation`1 innerOperation)
                        at _Diag_.Net._Async_Internals_()
                        at Microsoft.Dynamics.Nav.Service.ServiceOperationTracer.TraceScopeCombinator[T](Category telemetryCategory, ServiceOperationContext    
                     context, ServiceOperation`1 innerOperation)
                        at Microsoft.Dynamics.Nav.Service.ServiceOperationPipeline.<>c__DisplayClass7_0`1.<<PerformanceCounterCombinator>b__0>d.MoveNext()      
                        at _Diag_.Net._Async_Internals_()
                        at Microsoft.Dynamics.Nav.Service.ServiceOperationPipeline.<>c__DisplayClass7_0`1.<PerformanceCounterCombinator>b__0()
                        at Microsoft.Dynamics.Nav.Runtime.NavPerformanceCounterSetter.UpdatePerformanceCountersWithAverageServiceOperationAction(Func`1
                     action, NavSession session)
                        at _Diag_.Net._Async_Internals_()
                        at Microsoft.Dynamics.Nav.Service.ServiceOperationPipeline.PerformanceCounterCombinator[T](ServiceOperationContext context, 
                     ServiceOperation`1 innerOperation)
                        at _Diag_.Net._Async_Internals_()
                        at Microsoft.Dynamics.Nav.Service.ServiceOperationPipeline.PerformanceCounterCombinator[T](ServiceOperationContext context, 
                     ServiceOperation`1 innerOperation)
                        at Microsoft.Dynamics.Nav.Service.ServiceOperationPipeline.InitClientTelemetryIdsCombinator[T](ServiceOperationContext context,
                     ServiceOperation`1 innerOperation)
                        at Microsoft.Dynamics.Nav.Service.ServiceOperationPipeline.TlsClearCombinator[T](ServiceOperationContext context, ServiceOperation`1    
                     innerOperation)
                        at _Diag_.Net._Async_Internals_()
                        at Microsoft.Dynamics.Nav.Service.ServiceOperationPipeline.TlsClearCombinator[T](ServiceOperationContext context, ServiceOperation`1    
                     innerOperation)
                        at Microsoft.Dynamics.Nav.Service.AspNetCore.ClientService.ServiceOperationPipelineDispatchProxy`1.Invoke(MethodInfo targetMethod, 
                     Object[] args)
                        at generatedProxy_1.GetPage(PageRequestDefinition, NavRecordState)
                        at InvokeStub_generatedProxy_1.GetPage(Object, Span`1)
                        at System.Reflection.MethodBaseInvoker.InvokeWithFewArgs(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, 
                     CultureInfo culture)
                        at StreamJsonRpc.TargetMethod.InvokeAsync(CancellationToken cancellationToken)
                        at _Diag_.Net._Async_Internals_()
                        at System.Threading.QueueUserWorkItemCallback`1.Execute()
                        at _Diag_.Net._Async_Internals_()


                     ProcessId: 10692
                     Tag: 00000HC
                     ThreadId: 171
                     ExecutionId: 1518
                     CounterInformation:
                     CustomParameters: {
                     }
                     GatewayCorrelationId: '
Category           : (33)
CategoryNumber     : 33
ReplacementStrings : {Server instance: INSTANCENAMEREMOVED
                     Category: Runtime
                     ClientSessionId: 267253d0-65cd-49d1-a056-932574a1c5da
                     ClientActivityId: 14a9c0b0-7a31-28e7-046e-8864cc9aeb34
                     ServerSessionUniqueId: 454b7f9d-f789-491f-8c69-2137e5528890
                     ServerActivityId: 1238b3fb-cf55-4763-a432-f3f07ef3b65d
                     EventTime: 04/13/2026 12:11:51
                     Message (NavFilterException): Sending exception to client. Session terminating: False
                     ParentException: NavFilterException
                     Der Filter '<redacted>' ist für das Feld 'Herausgeber' der Tabelle 'Veröffentlichte Anwendung' nicht gültig. <redacted>
                     ExceptionStackTrace:
                        at Microsoft.Dynamics.Nav.Runtime.NavRecord.SetFilter(NCLMetaField metaField, NavFilter filter)
                        at Microsoft.Dynamics.Nav.Runtime.NavRecord.SetTableViewFilters(NavFilterGroup[] filterGroups, Predicate`1 condition)
                        at Microsoft.Dynamics.Nav.Service.NSDataSetState.ApplyToRecordWithoutPositioning(NavRecordState state, NsDataAccess recDataAccess)      
                        at Microsoft.Dynamics.Nav.Service.NSPage.<GetPageDataAsync>b__8_0(NsDataAccess recDataAccess)
                        at Microsoft.Dynamics.Nav.Service.NsFormDataAccess.RunWithFormDataAccessAsync[T](ITreeObject parent, NavForm form, Func`2 func)
                        at Microsoft.Dynamics.Nav.Service.NsDataAccess.RunWithDataAccessAsync[T](ITreeObject parent, NavRecordState state, Boolean
                     instantiateNewForm, Guid parentFormHandle, String parentControlName, Func`2 func)
                        at Microsoft.Dynamics.Nav.Service.NSPage.GetPageAsync(NavSession session)
                        at Microsoft.Dynamics.Nav.Service.AspNetCore.ClientService.ServiceOperationPipelineHelper.CallWithHandlingTargetInvocationException[T]( 
                     Func`1 asyncFunc)
                        at Microsoft.Dynamics.Nav.Service.ServiceOperationPipeline.StartSamplingProfilingCombinator[T](ServiceOperationContext context,
                     ServiceOperation`1 innerOperation)
                        at Microsoft.Dynamics.Nav.Service.ServiceOperationPipeline.AddSessionToThreadSchedulerCombinator[T](ServiceOperationContext context,    
                     ServiceOperation`1 innerOperation)
                        at Microsoft.Dynamics.Nav.Service.ServiceOperationPipeline.RunInTransactionCombinator[T](ServiceOperationContext context,
                     ServiceOperation`1 innerOperation)
                        at Microsoft.Dynamics.Nav.Service.ServiceOperationPipeline.TransientErrorRetryCombinator[T](ServiceOperationContext context,
                     ServiceOperation`1 innerOperation)
                        at Microsoft.Dynamics.Nav.Service.ServiceOperationPipeline.ErrorMappingCombinator[T](ServiceOperationContext context,
                     ServiceOperation`1 innerOperation, Boolean useCoreWcfFaultException)
                     InnerException:
                     ParentException: NavCSideException
                     Error Code:18023434
                     Der Filter '<redacted>' ist für das Feld 'Herausgeber' der Tabelle 'Veröffentlichte Anwendung' nicht gültig. <redacted>
                     ExceptionStackTrace:
                        at Microsoft.Dynamics.Nav.Runtime.RecordImplementationHelper.GetInvalidFilterException(NavRecord parentRecord, NCLMetaField metaField,  
                     String expression, Exception innerException)
                        at Microsoft.Dynamics.Nav.Runtime.RecordImplementation.SetFieldFilter(NCLMetaField metaField, String expression, String 
                     userTypedExpression, NavValue[] values)
                        at Microsoft.Dynamics.Nav.Runtime.NavRecord.SetFilter(NCLMetaField metaField, NavFilter filter)
                     InnerException:
                     RootException: NavInvalidFilterExpressionException
                     Fehler beim Interpretieren des Filters: „<redacted>“ wurde nicht erwartet.

                     Weitere Informationen finden Sie unter https://go.microsoft.com/fwlink/?linkid=2158058.
                     ExceptionStackTrace:
                        at Microsoft.Dynamics.Nav.Runtime.FilterExpressionParser.Parse(Boolean useOnlyVariableResolver, DataError dataError)
                        at Microsoft.Dynamics.Nav.Runtime.FilterExpressionParser.ParseWithoutBalancing(String expression, FilterExpressionContext
                     expressionContext, Func`3 customVariableResolver, Int32 unknownVariableResolverDepth, NavValue[] values, Int32& expressionLeafCount,       
                     Boolean& hasVariables, Boolean cultureInvariant, DataError dataError)
                        at Microsoft.Dynamics.Nav.Runtime.RecordImplementation.SetFieldFilter(NCLMetaField metaField, String expression, String 
                     userTypedExpression, NavValue[] values)
                     CallerStackTrace:
                        at Microsoft.Dynamics.Nav.Service.ServiceExceptionHandling.MapServiceOperationException(Exception e, NavSession session, Boolean        
                     useCoreWcfFaultException)
                        at Microsoft.Dynamics.Nav.Service.ServiceOperationPipeline.ErrorMappingCombinator[T](ServiceOperationContext context, 
                     ServiceOperation`1 innerOperation, Boolean useCoreWcfFaultException)
                        at _Diag_.Net._Async_Internals_()
                        at Microsoft.Dynamics.Nav.Service.ServiceOperationPipeline.ErrorMappingCombinator[T](ServiceOperationContext context,
                     ServiceOperation`1 innerOperation, Boolean useCoreWcfFaultException)
                        at Microsoft.Dynamics.Nav.Service.ServiceOperationPipeline.PartnerTelemetryPermissionErrorCombinator[T](ServiceOperationContext
                     context, ServiceOperation`1 innerOperation)
                        at _Diag_.Net._Async_Internals_()
                        at Microsoft.Dynamics.Nav.Service.ServiceOperationPipeline.PartnerTelemetryPermissionErrorCombinator[T](ServiceOperationContext
                     context, ServiceOperation`1 innerOperation)
                        at Microsoft.Dynamics.Nav.Service.ServiceOperationPipeline.PushPopCombinator[T](ServiceOperationContext context, ServiceOperation`1     
                     innerOperation, Boolean useCoreWcfFaultException)
                        at _Diag_.Net._Async_Internals_()
                        at Microsoft.Dynamics.Nav.Service.ServiceOperationPipeline.PushPopCombinator[T](ServiceOperationContext context, ServiceOperation`1     
                     innerOperation, Boolean useCoreWcfFaultException)
                        at Microsoft.Dynamics.Nav.Service.ServiceOperationTracer.TraceScopeCombinator[T](Category telemetryCategory, ServiceOperationContext    
                     context, ServiceOperation`1 innerOperation)
                        at _Diag_.Net._Async_Internals_()
                        at Microsoft.Dynamics.Nav.Service.ServiceOperationTracer.TraceScopeCombinator[T](Category telemetryCategory, ServiceOperationContext    
                     context, ServiceOperation`1 innerOperation)
                        at Microsoft.Dynamics.Nav.Service.ServiceOperationPipeline.<>c__DisplayClass7_0`1.<<PerformanceCounterCombinator>b__0>d.MoveNext()      
                        at _Diag_.Net._Async_Internals_()
                        at Microsoft.Dynamics.Nav.Service.ServiceOperationPipeline.<>c__DisplayClass7_0`1.<PerformanceCounterCombinator>b__0()
                        at Microsoft.Dynamics.Nav.Runtime.NavPerformanceCounterSetter.UpdatePerformanceCountersWithAverageServiceOperationAction(Func`1
                     action, NavSession session)
                        at _Diag_.Net._Async_Internals_()
                        at Microsoft.Dynamics.Nav.Service.ServiceOperationPipeline.PerformanceCounterCombinator[T](ServiceOperationContext context,
                     ServiceOperation`1 innerOperation)
                        at _Diag_.Net._Async_Internals_()
                        at Microsoft.Dynamics.Nav.Service.ServiceOperationPipeline.PerformanceCounterCombinator[T](ServiceOperationContext context,
                     ServiceOperation`1 innerOperation)
                        at Microsoft.Dynamics.Nav.Service.ServiceOperationPipeline.InitClientTelemetryIdsCombinator[T](ServiceOperationContext context,
                     ServiceOperation`1 innerOperation)
                        at Microsoft.Dynamics.Nav.Service.ServiceOperationPipeline.TlsClearCombinator[T](ServiceOperationContext context, ServiceOperation`1    
                     innerOperation)
                        at _Diag_.Net._Async_Internals_()
                        at Microsoft.Dynamics.Nav.Service.ServiceOperationPipeline.TlsClearCombinator[T](ServiceOperationContext context, ServiceOperation`1    
                     innerOperation)
                        at Microsoft.Dynamics.Nav.Service.AspNetCore.ClientService.ServiceOperationPipelineDispatchProxy`1.Invoke(MethodInfo targetMethod,      
                     Object[] args)
                        at generatedProxy_1.GetPage(PageRequestDefinition, NavRecordState)
                        at InvokeStub_generatedProxy_1.GetPage(Object, Span`1)
                        at System.Reflection.MethodBaseInvoker.InvokeWithFewArgs(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters,       
                     CultureInfo culture)
                        at StreamJsonRpc.TargetMethod.InvokeAsync(CancellationToken cancellationToken)
                        at _Diag_.Net._Async_Internals_()
                        at System.Threading.QueueUserWorkItemCallback`1.Execute()
                        at _Diag_.Net._Async_Internals_()


                     ProcessId: 10692
                     Tag: 00000HC
                     ThreadId: 171
                     ExecutionId: 1518
                     CounterInformation:
                     CustomParameters: {
                     }
                     GatewayCorrelationId: }
Source             : MicrosoftDynamicsNavServer$INSTANCENAMEREMOVED
TimeGenerated      : 13.04.2026 14:11:51
TimeWritten        : 13.04.2026 14:11:51
UserName           :
  1. Screenshots

1
11586×1754 828 KB

2
21157×369 87.2 KB

4

Alloy version: v1.15.1

5

Minor mistake above when setting, i actually the inserted something before 547333 → 547330 to trigger alloy at least processing the event. My insert above was wrong

C:\ProgramData\GrafanaLabs\Alloy\data\loki.source.windowsevent.application\bookmark.xml to:

<BookmarkList>
  <Bookmark Channel='Application' RecordId='547330' IsCurrent='false'/>
</BookmarkList>

Also adding those configuration items to config.alloy does not make a difference:

	exclude_event_data = true
	exclude_event_message = true
	exclude_user_data = true
}