type.inbound
and any(body.links,
(
.href_url.domain.root_domain == "youtube.com"
and strings.icontains(.href_url.path, 'logout')
// the redirect field
and strings.icontains(.href_url.query_params, "continue=")
and regex.icontains(.href_url.query_params,
'&continue=(?:https?)?(?:(?:%3a|\:)?(?:\/|%2f){2})?google\.com[^\&]*\/+amp\/+s\/+'
)
)
)
Playground
Test against your own EMLs or sample data.