Consider alert e-mails sent by a monitoring system. If they're received outside of business hours, we want to transfer them to some other mail account, for example one that is meant to be read on mobile.
Condition name: alert
Expression: from is "nagios@example.org" AND subject contains "** PROBLEM Service Alert"
Actions: none
Condition name: business hours
Expression: (now("hour") >= 9) AND (now("hour") < 18)
Actions: none
Condition name: (not necessary)
Expression: condition("alert") AND (NOT condition("business hours"))
Actions: redirect to mobile's email
Condition name: (not necessary)
Expression: condition("alert") AND condition("business hours")
Actions: set priority to +10
Normally, the presence of a Reply-To field suggests that a reply should go only to the addresses designated by the field, there-by ignoring the From and Cc fields. But this feature is sometimes misused, either by mailing-lists software or by senders who set up their mail account with a Reply-To field always set.
The filtering system provides an action that removes a specific header field. That can be used against these undesirable Reply-To fields. Example:
Expression: from is "specific-email@example.org" AND header("reply-to") is "specific-email@example.org"
Actions: Remove header field Reply-To
The current day is the first day of the month: now("day")="01" or now("day")==1 (with implicit conversion to numeric).
The year is 2016: now("year")="2016".
The day is exactly the November 17, 2016: now("date")="2016-11-16"
The sender's date on the message is November 17, 2016: date("date")="2016-11-16"