type.inbound
and any(attachments,
(.file_type == "pdf" or .file_extension == "pdf")
and any(file.explode(.),
any(.scan.pdf.urls,
.path == '/'
and regex.imatch(.query_params, '[A-Fa-f0-9+/]{8}')
and length(.query_params_decoded) == 1
and all(flatten(values(.query_params_decoded)), . == '')
)
)
)
Playground
Test against your own EMLs or sample data.