Windows Log Trigger Help

[NMS]

I having a very difficult time with this next trigger. I am monitoring windows logs for following items:

eventlog[Application,"Connection to Microsoft Exchange has been lost."]
eventlog[Application,"Connection to Microsoft Exchange has been restored."]

I am trying to create a trigger that will only alert eventlog[Application,"Connection to Microsoft Exchange has been lost."] until eventlog[Application,"Connection to Microsoft Exchange has been restored."] executes

Essentially I want item eventlog[Application,"Connection to Microsoft Exchange has been restored."] to OK the trigger.

I can not figure out for the life of me on how to do this. Any help is appreciated.

[Koral]

Two things come in my mind (but didn't test it as I did not had to):

1.
lost.connection.count(300)>1 & restore.connection.count(300)=0
explanation:
if in 5min (you don't have to use 5min, but don't use less than item interval) there comes an entry of lost connection alert fires, then comes entry of restored connection so the trigger goes off.
Of course I can imagine that sometimes there can be a "gap" and the trigger won't fire.

so...

2.
(lost.connection.count(300)>1 & {TRIGGER.VALUE}=1) |
(restore.connection.count(300)>1 & {TRIGGER.VALUE}=0)

or perhaps...

3.
(lost.connection.str(lost)=1 & {TRIGGER.VALUE}=1) |
(restore.connection.str(restored)=1 & {TRIGGER.VALUE}=0)
in string function give something corresponding to the text in those events

[NMS]

Is this what you meant?

(eventlog[Application,"Connection to Microsoft Exchange has been lost."]=1 & {TRIGGER.VALUE}=1) |
(eventlog[Application,"Connection to Microsoft Exchange has been restored."]=1 & {TRIGGER.VALUE}=0)

No dice if so