type.inbound
and any(body.current_thread.links,
.href_url.domain.root_domain in $url_shorteners
and .href_url.fragment is not null
and length(.href_url.fragment) > 5
and strings.contains(subject.subject, .href_url.fragment)
)
Playground
Test against your own EMLs or sample data.