mysql need help optimizing query
I agree with @ypercubeᵀᴹ, the comma join in the exists clause can be removed:

select hostname, criticality, source, message, record_date
from eventlog.logs l1
where not exists ( 
    SELECT 1
    FROM eventlog.rules r
    where l1.message like r.content
      and r.type = 'DROP'
) 
and criticality in ('High', 'Medium')
and record_date &gt; sysdate() - Interval 2 Day
order by l1.message;


I also replaced the selected columns in the subquery with 1 since it really does not matter what you select, and replaced the OR predicate with IN.