Email: Conditions & Values from the Email

An email flow decides which emails matter using conditions, and it can pull values out of the email (a server name, a job name, a ticket number) to use in the alert, or to hand to an action. This page explains both, with examples.

This page is about matching emails. Setting up the mailbox itself is covered in Email (IMAP) Monitoring. To have a matching email do something, such as submit a JAMS Scheduler job, see Email: Taking Action Automatically.

The short version

Add one or more conditions, e.g. Subject contains FAILED.
Choose whether they combine with AND (every condition must match) or OR (any one is enough).
Optionally, add values to pull out of the email, e.g. the text after Server:.
Use those values in your alert message as {{Server}}.
Click Test with a sample email, paste a real example, and check it does what you expect before you save.

Conditions

A condition has three parts: where to look, how to compare, and what to look for.

Where to look

Field	What it checks
Subject	The email's subject line.
From	The sender, both their name and their address (e.g. `Monitoring <alerts@example.com>`).
To / Cc	Everyone the email was sent to, including Cc.
Body	The text of the email. If the email is HTML only, its text is used.

How to compare

Choice	Matches when…	Example
contains	the text appears anywhere	Subject contains `FAILED`
does not contain	the text does not appear anywhere	Body does not contain `test run`
equals	the whole field is exactly the text	From equals `alerts@example.com`
does not equal	the whole field is anything else	Subject does not equal `Daily summary`
starts with	the field begins with the text	Subject starts with `[PROD]`
ends with	the field ends with the text	Subject ends with `- action required`
matches regex	a regular expression matches (advanced)	Body matches regex `exit code [1-9]`
does not match regex	the regular expression does not match

A few details worth knowing:

Case is ignored by default: FAILED also matches failed. To match case exactly, click Aa next to the condition; it lights up when on. Hover over it to see which it is.
"From equals" compares the address only, so you can type alerts@example.com without worrying about the sender's display name. From contains still sees the name too.
Regular expressions are optional. Everything most people need can be done with contains, starts with and equals. If you do use one, it is checked when you save, so a broken pattern can't be saved.

Combining conditions: AND and OR

When a flow has more than one condition, choose how they combine:

AND — every condition must match. Subject contains FAILED AND From equals alerts@example.com only fires for failures from that sender.
OR — any one condition is enough. Subject contains FAILED OR Subject contains ERROR fires for either word.

Use the AND | OR switch above the conditions, or click the AND / OR word between two conditions to flip it.

Mixing AND with OR: groups

Sometimes you need both. For example: "failures from our scheduler, or anything that says CRITICAL, wherever it comes from."

Put the first set in a group: Subject contains FAILED AND From equals jams@example.com.
Click + Add another group of conditions and add Body contains CRITICAL.
Set the groups to combine with OR.

That reads as: (Subject contains FAILED AND From is jams@example.com) OR (Body contains CRITICAL).

Each group has its own AND / OR switch, and the groups have one between them. Two levels covers almost everything. If a rule is getting complicated, it is often clearer as two separate flows.

Upgrading an older flow

Flows created before conditions existed had one Keyword (matched against the subject) and an optional From Address. They keep working exactly as before. When you open one, you'll see them shown as Subject contains … AND From contains …. Nothing changes until you edit and save the conditions.

Matching on the body

Body conditions read the text of the email. A few things to know:

The body is only downloaded for flows that use it, through a Body condition, a value taken from the body, or {{body}} in the message. Flows that only look at the subject and sender keep the lighter check they always had.
Very long emails are read up to the first 100,000 characters, which is far more than any alert email needs.
On a very busy mailbox, each check handles up to 100 new emails, oldest first, and the next check carries on with the rest. Check more often rather than less.

Pulling values out of the email

A value (or variable) is a piece of the email you want to reuse: a server name, a job name, a ticket number. Give it a name, say where it comes from, and say how to find it.

The easy way: "text after"

Most alert emails label their details, like this:

The following job failed.
Server: SQLPROD02
Job: LoadGL
Run #48213 ended with exit code 3

To capture the server name, add a value:

Name	From	Text after	Up to
`Server`	Body	`Server:`	(leave empty)

That reads SQLPROD02. With Up to left empty, the value runs to the end of that line. Fill in Up to when the value stops at some other text on the same line or a later one. It's forgiving:

Server and Server: both work. A colon or equals sign after the label is skipped.
Capital letters don't matter.
If the label word also appears earlier in normal sentences ("the server was restarted"), the line that looks like a label is preferred: one with a colon after it, or at the start of a line.
Spaces around the value are trimmed.

The advanced way: regex

Under Advanced: use a regex, a value can come from a regular expression. The first group in brackets is used, or the whole match if there is no group. For example Run #(\d+) reads 48213 from the email above.

Naming values

Names start with a letter and use letters, digits and _ (e.g. Server, JobName, Ticket_No). They can't reuse the built-in names below.

When a value isn't in the email

If the text isn't found, the value is empty. In an alert message that just leaves a blank. If an action needs the value (for example a JAMS Scheduler job parameter), the action is not run and people are paged instead, with the reason in the alert. Running a job with a blank server name is worse than asking a person. See Email: Taking Action Automatically.

Using values in the alert message

In the flow's Custom Alert Message, write any value in double curly brackets:

{{JobName}} failed on {{Server}}. Subject: {{subject}}

These are always available, without defining anything:

Placeholder	What you get
`{{subject}}`	The email's subject
`{{from}}`	The sender
`{{to}}`	The To and Cc addresses
`{{date}}`	When the email was received
`{{body}}`	The email's text, on one line and cut to 1,000 characters, because it is read aloud and sent by SMS

A placeholder that doesn't exist is refused when you save, so a typo like {{JobNmae}} can never reach someone's phone as a blank. If you leave the custom message empty, alerts say who the email is from and its subject, as before. The body is only included if you add {{body}}.

Test before you save

Open Test with a sample email at the bottom of the conditions. Paste in the From, Subject and Body of a real example, and click Run test. You'll see:

whether this email would trigger the flow (and, with groups, which groups matched);
what each value picked up, with any that were not found in red;
the exact alert message that would be sent.

Nothing is sent and no mailbox is read. It's the quickest way to get a rule right.

Worked example

Goal: page the on-call team when the backup system reports a failure for a production server, and tell them which server.

The emails look like:

From: Backup <backup@example.com>
Subject: [PROD] Backup FAILED
Body:  Host: FS-PROD-01
       Error: disk full

Conditions, combined with AND:
- From equals backup@example.com
- Subject starts with [PROD]
- Subject contains FAILED
Values:
- Host, from Body, text after Host:
- Error, from Body, text after Error:
Custom message: Backup failed on {{Host}}: {{Error}}
Test with the example above. It should show would trigger, Host = FS-PROD-01, Error = disk full, and the message Backup failed on FS-PROD-01: disk full.

Troubleshooting

Symptom	Likely cause	What to do
A flow never fires	One AND condition never matches	Paste a real email into Test with a sample email. It shows which group failed.
It fires too often	Conditions are combined with OR	Switch to AND, or move the OR into its own group.
A value comes out empty	The label text differs (e.g. `Server name:` instead of `Server:`)	Copy the label exactly from a real email, then test.
A value picks up too much	It runs to the end of the line	Fill in Up to with the text that follows the value.
"uses {{X}}, which is not a variable" on save	A typo, or the value isn't defined	Fix the name, or add the value under Pull values out of the email.
"invalid regex" on save	The pattern has a syntax error	Check the brackets, or use contains / text after instead.
Alerts arrive late on a very busy mailbox	Each check handles up to 100 new emails	Check more often (every minute), or narrow what lands in that mailbox.