type.inbound
and any(filter(body.previous_threads,
// single recipient in the previous thread
length(.recipients.to) == 1
and length(.recipients.cc) == 0
// contains spaces around the colons of the "headers"
and strings.count(.preamble, ' : ') >= 2
and regex.icount(.preamble, '(?m)^\s*[a-z]+ +: +\S') == regex.icount(.preamble,
'(?m)^.'
)
),
// the previous thread with the goofy spaces
// includes a VIP as a recipient
any(map(filter(.recipients.to,
// via email
.email.email != ""
and any($org_vips,
strings.icontains(..email.email, .email)
or strings.icontains(..display_name,
.display_name
)
)
),
.email.email
),
// email is not in the "live" messages
not strings.icontains(sender.email.email, .)
and not any(recipients.to, strings.icontains(.email.email, ..))
and not any(recipients.cc, strings.icontains(.email.email, ..))
)
or any(map(filter(.recipients.to,
// via display_name
.email.email == ""
and any($org_vips,
strings.icontains(..display_name,
.display_name
)
)
),
.display_name
),
// display name is not in the "live" messages
not any(recipients.to, .display_name == ..)
and not any(recipients.cc, .display_name == ..)
and sender.display_name != .
)
)
Playground
Test against your own EMLs or sample data.