Hi David, Andrew Thank you for your feedback.
Finally I found out why this filter hasn't triggered before in my NEWFILTER file I use to test new patterns. I comment out older tests but keep them in the file including all my comments. In this case I missed to disable the following line _below_ the current investigation (the PCRE for this link) HEADERS END NOTCONTAINS Subject: =?utf-8 So just for your information: Such an END statement will end the test sequence of this filter file WITHOUT adding any points already triggered before. (in my case the PCRE signature for the link) Instead of completely avoiding END statements in the middle of a filter file you can use a STOPATFIRSTHIT on top of the filter file in order to let count at least that first triggered line. Kind regards and thanks again Andrew for the little RegEx course... Markus Von: community@mailsbestfriend.com [mailto:community@mailsbestfriend.com] Im Auftrag von David Barker | Mail's Best Friend | 1-866-919-2075 Gesendet: Mittwoch, 5. Oktober 2016 16:16 An: community@mailsbestfriend.com Betreff: [MBF] Re: another question about PCRE I need to see the exact line from your Filter. I want to make sure the syntax is correct as the regex itself looks like it should be working. From: community@mailsbestfriend.com<mailto:community@mailsbestfriend.com> [mailto:community@mailsbestfriend.com] On Behalf Of Markus Gufler | Limitis Sent: Tuesday, October 4, 2016 11:51 PM To: community@mailsbestfriend.com<mailto:community@mailsbestfriend.com> Subject: [MBF] Re: another question about PCRE I'm mobile at the moment but it's BODY 77 PCRE followed by one of the two regex in the links. Am 05.10.2016 5:30 vorm. schrieb David Barker | Mail's Best Friend | 1-866-919-2075 <david.bar...@mailsbestfriend.com<mailto:david.bar...@mailsbestfriend.com>>: Can you send me the exact line in your filter for Declude. From: community@mailsbestfriend.com<mailto:community@mailsbestfriend.com> [mailto:community@mailsbestfriend.com] On Behalf Of Markus Gufler | Limitis Sent: Tuesday, October 4, 2016 4:06 AM To: community@mailsbestfriend.com<mailto:community@mailsbestfriend.com> Subject: [MBF] another question about PCRE Hi all I try to catch URLs like these (screenshot) [cid:image001.jpg@01D21E8E.575CE220] I tried to do this with two variants of a regex https://regex101.com/r/i3TVSc/1 and https://regex101.com/r/zdJ5r5/1 but both seems not being triggered within Declude. Any idea? Markus
