type.inbound
and any(body.links,
.href_url.domain.domain == 'manage.kmail-lists.com'
and .href_url.path =~ '/subscriptions/subscribe/update'
and strings.icontains(.href_url.query_params, 'r=')
and not strings.ilike(.display_text, "*subscribe*", "*manage*")
)
Playground
Test against your own EMLs or sample data.