Flow Operator

The output set of events of the left-hand side operation is the input set of events for the right-hand side operation. Flow is typically used to transition from one correlation operation to the next.

For example:

filter(e.sev = 5) flow trigger(3, 60)

The output of the filter operation is the input of the trigger operation. The trigger only counts events with severity equal to 5.