The output of a filter is either the empty set (if the Boolean expression evaluates to false) or a set containing the current event and all of the other events from the incoming set (if the Boolean expression evaluates to true).
If filter is the last or only operation of a correlation rule, then the output set of the filter is used to construct a correlated event. The trigger events are the filter operation output set of events with the current event first.
If filter is not the last operation of a correlation rule (i.e., filter is followed by a flow operatior), then the output set of a filter is used as the input set to other operations (through the flow operator).