# Add the event source to the subject of an email notification

**URL:** https://community.graylog.org/t/add-the-event-source-to-the-subject-of-an-email-notification/12972
**Category:** Graylog Central (peer support)
**Created:** [November 27, 2019, 4:54pm UTC](https://community.graylog.org/t/add-the-event-source-to-the-subject-of-an-email-notification/12972 "2019-11-27T16:54:03Z")
**Posts on this page:** 1
**Showing post:** 7

<div class="post-metadata">

### Author: ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)
#### Post date: [November 29, 2019, 7:20am UTC](https://community.graylog.org/t/add-the-event-source-to-the-subject-of-an-email-notification/12972/7 "2019-11-29T07:20:20Z")

</div>

It works. If you want source field in subject, you need to use `{$message.source}`:

`${foreach backlog message}${message.source}${end}`

If you want to use user field (for example: src\_ip) use `{$message.fields.src_ip}` as @tmacgbay suggested:  
` ${foreach backlog message}${message.fields.src_ip}${end}`

For example I use this subject after somebody connect to switch:

`User ${foreach backlog message}${message.fields.username}${end} connected to switch ${foreach backlog message}${message.source}${end} from IP ${foreach backlog message}${message.fields.src_ip}${end}`

If didn’t work for you, check if you have setup `Message backlog` to 1 on `Notification` tab of your Event `Definition`.

---

_[View the full topic](https://community.graylog.org/t/add-the-event-source-to-the-subject-of-an-email-notification/12972)._