How do I build a trigger on the ticket subject

You can, and there are two operator families that mean different things. Both are less reliable on human text than they look.

You can, and there are two operator families that mean different things. Both are less reliable on human text than they look, so check which you picked.

Which operator should I use on the subject line?

To catch several phrases with the string operators, each phrase needs its own condition under Meet ANY of the following conditions. A condition for "yummy pie" does not also cover "pie": that is a second condition.

Why it disappoints on real mail

Customers do not use your words. A rule looking for "invoice" misses "bill", "payment" and "factuur", and you will keep discovering new ones.

Replies carry the old subject. Re: threads keep matching long after the conversation moved on to something else.

Automated mail contains anything. A rule on "urgent" fires on every marketing email that reaches your support address.

Two better routes. Ask on the form: a category field gives you a controlled value that means what it says, and if the ticket came through your help centre you already have one. Use intelligent triage where you have it, because it classifies by intent rather than by keyword, which is what you were trying to do.

Subject matching is fine for exact machine-generated text. A monitoring system that always sends "ALERT: disk full" matches reliably, because the sender is a machine and the wording is fixed. That is the honest boundary: machine text yes, human text no.

See also

• What intelligent triage does
• How does the comment text condition work
• Designing a form that helps agents and customers both