A quick summary of how to specify the "match expression" (regex) when creating an email scan filter.
A filter is applied to email messages to find matching candidates for importing/tracking and/or tagging.The following message headers are examined: From:, Reply-To:, To:, Bcc:, and Subject:
The matching expression is a list of conditions that are AND'ed:
rto:keyword - means email address of the Reply-To: header contains 'keyword'
from:keyword - means email address of the From: header contains 'keyword'
to:keyword - means email address of the To: header contains 'keyword'
bcc:keyword - means email address of the Bcc: header contains 'keyword'
fromto:keyword - means email address of the From: OR To: headers contains 'keyword'
subject:keyword - means subject contains 'keyword' (case insensitive)
Instead of a keyword it could be a phrase, then you need to use quotes, i.e. subject:"match this subject"
The '^' modifier means the match should start with the following keyword or phrase, i.e. to:^startKeyword
The '-' modifier means the following keyword/phrase is absent, i.e fromto:-negativeKeyword