Adding a hostname filter won't help much. Filters are sequential, if the message text filter matches it moves to the hostname filter. If that matches it moves to the time interval and so on. Since you really only need to match on message text it doesn't do anything.
In other filters, like Threshold, there is a checkbox for enabling individual host status. Without that in the app, it would have to be scripted.
You could do it in memory with data dictionaries or log to a hostname specific file(using autosplit) and run a task that checks the for file every 30 minutes. If the file exists, generate an email, event log or whatever and delete the file.