type.inbound
and any(filter(attachments, .file_type == "pdf"),
any(file.explode(.),
.scan.pdf_obj_hash.object_hash in (
"c515d2cb8f93b87bc4891a411ab37e6d",
"a67f29d92dd43a924218dc6a437c13d6"
)
)
)
Playground
Test against your own EMLs or sample data.