It sounds like you are doing it correctly. Have you tried to search for either 'esx.audit.host.boot' or 'Host has booted'? Do either return results? What do you have the time range set to? Perhaps expand the time range? Are you sure the hosts in question are logging to Log Insight? ESXi 5.0 has a known issue in that versions prior to 5.0 update 2 on UDP and all version on TCP can stop remote logging (i.e. logging to Log Insight) if a remote syslog destination becomes unavailable. When this occurs you need to reload the syslog process on the ESXi hosts (the configure-esxi script on the Log Insight virtual appliance can do this for you through use of the -r flag).
I do not have an environment that has the core dump message, but I do have one where the host has booted message appears and searching for either 'esx.audit.host.boot' or 'Host has booted' I do get results. I hope this helps!