Online Help

Match Expression is a text field which accepts a certain syntax that defines the rule expression.
Expression consists of matchers, operators and values which defines a condition.

matcher operator "value"

A simple example of a condition would be:
Date == "2006.02.23"
where Date is the matcher, == is the operator and "2006.02.23" is the value.
This condition can be read as "If the Date is equal to 2006.02.23".

You can join multiple conditions with clauses or negate them;

Condition1 AND Condition2 => If Condition1 and Condition2 are both true
Condition1 OR Condition2 => If Condition1 or Condition2 is true
NOT Condition1 => Reverse Condition1; false if true, true if false

Conditions can also be parenthesized set of matchers;

Date == "2006.02.23" AND (HeaderField "X-Priority:" < "4" AND HeaderField "X-Priority:" != "1")

As you can see from the above example, we are following the syntax of if-then statement in C

Following are the available matchers: <SP> is referring to the single space separation (Space bar).

Matcher	Usage	Description	API	Example
smtp.mail_from	smtp.mail_from	SMTP command MAIL FROM: value	N/A	smtp.mail_from != "ivar@lumisoft.ee"
smtp.rcpt_to	smtp.rcpt_to	SMTP command RCPT TO: values	N/A	smtp.rcpt_to == "me@domain.com"
smtp.ehlo	smtp.ehlo	SMTP command EHLO/HELO: value	N/A	smtp.ehlo == "ABC Server ready"
smtp.authenticated	smtp.authenticated	Specifies if SMTP session is authenticated	N/A	smtp.authenticated == true
smtp.user	smtp.user	SMTP authenticated user name. Empy string "" if not authenticated	N/A	smtp.user =="ivar"
smtp.remote_ip	smtp.remote_ip	SMTP session connected client IP address	N/A	smtp.remote_ip == "192.168.1.10"
message.size	message.size	Message size in bytes	N/A	message.size > "1024"
message.header	message.header <SP> "HeaderFieldName:"	Message main header header field. If multiple header fields, then all are checked	N/A	message.header "CustomHeader:" == "YES"
message.all_headers	message.all_headers <SP> "HeaderFieldName:"	Any mime entity header field. If multiple header fields, then all are checked.	N/A	message.all_headers "CustomHeader:" =="YES"
message.body_text	message.body_text	Plain text body of the message	N/A	message.body_text * "viagra"
message.body_html	message.body_html	HTML body of the message	N/A	message.body_html * "size=12"
message.content_md5	message.content_md5	Message any mime entity decoded data MD5 hash.	N/A	message.content_md5 == "A3BE4D3C553CA"
sys.date_time	sys.date_time	System current date time. Format: yyyy.MM.dd HH:mm:ss	N/A	sys.date_time == "2006.01.01 24:00:00"
sys.date	sys.date	System current date. Format: yyyy.MM.dd	N/A	sys.date == "2006.01.01"
sys.time	sys.time	System current time. Format: HH:mm:ss.	N/A	sys.time=="24:00:00"
sys.day_of_week	sys.day_of_week	Day of week. Days: sunday,monday, tuesday, wednesday, thursday, friday, saturday.	N/A	sys.day_of_week =="sunday"
sys.day_of_month	sys.day_of_month	Day of month. Format: 1 - 31. If no so much days in month, then replaced with month max days.	N/A	sys.day_of_month == "31"
sys.day_of_year	sys.day_of_year	Month of year. Format: 1 - 12	N/A	sys.day_of_year =="12"

Matcher

Usage

Description

API

Example

smtp.mail_from

smtp.mail_from

SMTP command MAIL FROM: value

N/A

smtp.mail_from != "ivar@lumisoft.ee"

smtp.rcpt_to

smtp.rcpt_to

SMTP command RCPT TO: values

N/A

smtp.rcpt_to == "me@domain.com"

smtp.ehlo

smtp.ehlo

SMTP command EHLO/HELO: value

N/A

smtp.ehlo == "ABC Server ready"

smtp.authenticated

smtp.authenticated

Specifies if SMTP session is authenticated

N/A

smtp.authenticated == true

smtp.user

smtp.user

SMTP authenticated user name. Empy string "" if not authenticated

N/A

smtp.user =="ivar"

smtp.remote_ip

smtp.remote_ip

SMTP session connected client IP address

N/A

smtp.remote_ip == "192.168.1.10"

message.size

message.size

Message size in bytes

N/A

message.size > "1024"

message.header

message.header <SP> "HeaderFieldName:"

Message main header header field. If multiple header fields, then all are checked

N/A

message.header "CustomHeader:" == "YES"

message.all_headers

message.all_headers <SP> "HeaderFieldName:"

Any mime entity header field. If multiple header fields, then all are checked.

N/A

message.all_headers "CustomHeader:" =="YES"

message.body_text

message.body_text

Plain text body of the message

N/A

message.body_text * "viagra"

message.body_html

message.body_html

HTML body of the message

N/A

message.body_html * "size=12"

message.content_md5

message.content_md5

Message any mime entity decoded data MD5 hash.

N/A

message.content_md5 == "A3BE4D3C553CA"

sys.date_time

sys.date_time

System current date time. Format: yyyy.MM.dd HH:mm:ss

N/A

sys.date_time == "2006.01.01 24:00:00"

sys.date

sys.date

System current date. Format: yyyy.MM.dd

N/A

sys.date == "2006.01.01"

sys.time

sys.time

System current time. Format: HH:mm:ss.

N/A

sys.time=="24:00:00"

sys.day_of_week

sys.day_of_week

Day of week. Days: sunday,monday, tuesday, wednesday, thursday, friday, saturday.

N/A

sys.day_of_week =="sunday"

sys.day_of_month

sys.day_of_month

Day of month. Format: 1 - 31. If no so much days in month, then replaced with month max days.

N/A

sys.day_of_month == "31"

sys.day_of_year

sys.day_of_year

Month of year. Format: 1 - 12

N/A

sys.day_of_year =="12"

Operator	Usage	Description	API info	Example
>	> <SP> "value"	matcher bigger than value	N/A	HeaderField "X-Priority:" > "2"
<	< <SP> "value"	matcher smaller than value	N/A	HeaderField "X-Priority:" < "4"
!=	!= <SP> "value"	matcher Not equal to value.	N/A	smtp.mail_from != "ivar@lumisoft.ee"
==	== <SP> "value"	matcher Equal to value	N/A	smtp.mail_from == "ivar@lumisoft.ee"
>=	>= <SP> "value"	matcher bigger or equal to value	N/A	HeaderField "X-Priority:" >= "3"
<=	<= <SP> "value"	matcher smaller or equal to value	N/A	HeaderField "X-Priority:" <= "3"
*	* <SP> "value"	matcher asterisk pattern match to value	N/A	HeaderField "From:" * "Ivar"
!*	!* <SP> "value"	matcher asterisk pattern reverse (not match the pattern)	N/A	HeaderField "From:" !* "spammer@spam.com"

Operator

Usage

Description

API info

Example

> <SP> "value"

matcher bigger than value

N/A

HeaderField "X-Priority:" > "2"

< <SP> "value"

matcher smaller than value

N/A

HeaderField "X-Priority:" < "4"

!= <SP> "value"

matcher Not equal to value.

N/A

smtp.mail_from != "ivar@lumisoft.ee"

== <SP> "value"

matcher Equal to value

N/A

smtp.mail_from == "ivar@lumisoft.ee"

>= <SP> "value"

matcher bigger or equal to value

N/A

HeaderField "X-Priority:" >= "3"

<= <SP> "value"

matcher smaller or equal to value

N/A

HeaderField "X-Priority:" <= "3"

* <SP> "value"

matcher asterisk pattern match to value

N/A

HeaderField "From:" * "Ivar"

!* <SP> "value"

matcher asterisk pattern reverse (not match the pattern)

N/A

HeaderField "From:" !* "spammer@spam.com"

Date == "19.02.2006" HeaderField "From:" * "*Ivar*" MainHeaderField "Content-Disposition:" * "*aNL.txt*" Date == "20.02.2006" AND smtp.mail_from != "ivar@lumisoft.ee"

HeaderField "From:" * "*Ivar*" OR (HeaderField "X-Priority:" < "4" AND HeaderField "X-Priority:" != "1") HeaderField "MyCustomHeader:" == "THE_VALUE" AND sys.date > "01.01.2006"