create index ix1 on appsec(event.categoryParams.severity, event.eventTimeInGmt) where _type=‘event’ ;