An alert seems to be exactly what you want to do.
You define a search for host=host1, schedule it to run every five minutes or so, and if it returns results, you send an email to some user. You do that for all alerts you want to receive.
Oh. Well it is probably possible to do that in an automated fashion as well, maybe via a lookup to determine the adressee and with
sendemail. Unfortunately, I don't know how to right off the bat.
That my original approach however the field does not take other fields as an accepted argument. For example, if on of the field is called email, using to=email will make an attempt to send an email to