Filter is used to filter the incoming stream on some condition and then send the filtered data to other stream and/or notify as required. Here is how it looks:

"fltr":[{"name":"f1", "fqry":{"name":"{"query":[{"key":"h", "cmp_op":0, "val":"$n"}],"qtype":2}", "type":1},
"fatr":["a", "b", "c", "g"],
"catr":[{"name":"f1", "type":11, "opid":3, "iatr":["b", "c"]]}], "ostm":"s2", "notf":1}, {"name":"f2", "fqry":{"name":"fltr_udf1", "type":2},
"fatr":["a", "b"], "catr":[{"name":"fltr1", "type":5, "opid":1", "iatr":["b"]]}]

Now let's look at the first one

{
   "name":"f1",
   "fqry":{
      "name":"{"query":[{"key":"h", "cmp_op":0, "val":"$n"}],"qtype":2}",
      "type":1
   },
   "fatr":[
      "a",
      "b",
      "c",
      "g"
   ],
   "catr":[
      {
         "name":"f1",
         "type":11,
         "opid":3,
         "iatr":[
            "b",
            "c"
         ]
      }
   ],
   "ostm":"s2",
   "notf":123
}

It creates a filter name f1, which filters based on fqry. As you see fqry is based on dataQuery (type which is also used to create query for db), for more discussion on this, please see dataQuery for more details.

In this example, fqry tells to filter all events where value of attr “h” is GT the attr value "n", both h and n are in same event stream. Once filtered (the fqry condition is satisfied), then it will send the data (filtered event) to other stream "s2" Before sending, it will select "fatr" set of attributes from this event ("a", "b", "c", "g") to send to other stream "s2"

"catr" is optional, if you wish to compute another attribute which will be part of the set of attributes sent to the other stream ("s2"), then we can define "catr". Here it computes attr "f1" of type "double" (11) by multiplying ("opid" = 3) "b and "c".

"fatr" is set of attributes that we send to filtered stream "s2", also on the fly we compute attribute f1 using "catr" which would be added to fatr set and sent to the output stream s2. See catr for more info on how to compute attribute.