What is the syntax for the 'begin' operator in a Rule clause?

[Anonymous]

For example, Rule Test with the following query :

device.type = "winevent_nic" && alert.id =  "access:privilege-escalation-success" && ip.addr = "13.101.134.216"

returns 12 values. However, Rule Test with the following query (same exact time range):

device.type = "winevent_nic" && alert.id =  "access:privilege-escalation-success" && ip.addr begins "13.101."

returns "No Values Available For The Rule."

[Anonymous]

I see. Thank you Fielder.