I need an alert where you get this message "Attempting to send email to:<email>" but you don't ever get the message "Email sent successfully" within 1-2 minutes. The problem is if you don't get the second message, a restart will be required before you do. So I need event 1, but no event 2
you should try something like this:
index=your_index ("Attempting to send email to:" OR "Email sent successfully") | eval message_kind=if(searchmatch("Attempting to send email to:"),"1","2") | stats dc(message_kind) AS dc_message_kind values(message_kind) AS message_kind | where dc_message_kind=1 AND message_kind="1"
as you asked the above search takes logs and check if the first message is followed by the second, the alert triggers when the first message isn't followed by the second (the where condition).