type.inbound
and any(body.links,
(
strings.iends_with(.href_url.path, 'redirect.html')
or strings.istarts_with(.href_url.fragment,
'/redirect.html',
'redirect.html?'
)
)
and .href_url.domain.domain == "storage.googleapis.com"
)
Playground
Test against your own EMLs or sample data.