It works. If you want source field in subject, you need to use {$message.source}:
${foreach backlog message}${message.source}${end}
If you want to use user field (for example: src_ip) use {$message.fields.src_ip} as @tmacgbay suggested:
${foreach backlog message}${message.fields.src_ip}${end}
For example I use this subject after somebody connect to switch:
User ${foreach backlog message}${message.fields.username}${end} connected to switch ${foreach backlog message}${message.source}${end} from IP ${foreach backlog message}${message.fields.src_ip}${end}
If didn’t work for you, check if you have setup Message backlog to 1 on Notification tab of your Event Definition.