Consider alert e-mails sent by a Nagios monitoring system. If they're received outside of business hours, we want to transfer them to some other mail account, for example one that is routed to a mobile phone.
Condition name: alert
Expression: from is "nagios@domain.tld" AND subject contains "** PROBLEM Service Alert"
Actions: none
Condition name: business hours
Expression: (now("hour") >= 9) AND (now("hour") < 18)
Actions: none
Condition name: (not necessary)
Expression: condition("alert") AND (NOT condition("business hours"))
Actions: redirect to mobile's email
Condition name: (not necessary)
Expression: condition("alert") AND condition("business hours")
Actions: set priority to +10
Normally, the presence of a Reply-To field suggests that a reply should go only to the addresses designated by the field, there-by ignoring the From and Cc fields. But this feature is sometimes misused, either by mailing-lists software or by senders who set up their mail account with a Reply-To field always set.
The filtering system provides an action that removes a specific header field. That can be used against these undesirable Reply-To fields. Example:
Expression: from is "specific-email@domain.tld" AND header("reply-to") is "specific-email@domain.tld"
Actions: Remove header field Reply-To
The current day is the first day of the month: now("day")="01"
or now("day")==1
(with implicit conversion to numeric).
The year is 2011: now("year")="2011"
.
The day is exactly the November 17, 2011: now("date")="2011-11-17"
The sender's date on the message is November 17, 2011: date("date")="2011-11-17"