Search code examples
reverse-engineeringazure-application-insights

Can you reverse engineer Saved Query link to Application Insights?


In Analytics, if I try to Export > Share a Link to Query then a URL is copied to my clipboard.

It has the following structure:

https://analytics.applicationinsights.io/subscriptions/[subscription id]/resourcegroups/Default-ApplicationInsights-[region]/components/[resource]?q=[alphanumeric string]&apptype=web

The alphanumeric string is some sort of encoding of the actual query. Why do I say that? Because it grows or shrinks according to the size of the query. I tried seeing if it was Base64 or UUencode but neither worked. Also I tried 5 a's and 5 b's followed by 10 c's in the query (arbitrary query) to see if I would see a pattern but that didn't help either.

Some analysis with Unix tools showed that the alphanumeric string is a character set with 0-9, A-Z, +, /, and =.

Does anybody know this format so that I can make arbitrary query URLs?

Alternately being able to submit parameters to the query would solve my problem. My motivation is to link to Application Insights from my website and go to dynamic queries.

Examples of the encoded part:

Query: aaaaabbbbbbccccccccccc
Encoding: ?q=H4sIAAAAAAAAA0tMBIIkMEhGAC4AHRlzExcAAAA%3D
Query: abcdefghijklmnopqrstuvwxyz0123456789
Encoding: ?q=H4sIAAAAAAAAA0tMSk5JTUvPyMzKzsnNyy8oLCouKS0rr6isMjA0MjYxNTO3sOQCANVo3%2FUlAAAA


Solution

  • There are 2 options to link a query.

    1. Encoded query (works well for lengthy queries and special characters). The format is q=EncodedQuery. EncodedQuery is the query, encoded in the following way: (a) first it is compressed via gzip, and (b) then it is encoded using base64 encoding.

    2. Plain text query. The format is query=QueryText. The downside is that the query length is (more) limited by browser's URL length limit. It may also not play well with special characters.

    Hope that helps,

    Yoram