If you want to use user field (for example: IpAddress) use {$message.fields.IpAddress} :
${foreach backlog message}${message.fields.IpAddress}${end}
You need to to use cycle foreach for backlog if you want to use message fields.
Also don’t forgot, that you have to setup number of backlog to 1: in Alerts - Event Definitions - tab Notifications and field Message Backlog, tick the checkbox and set 1.
You can also use same technique in message subject, for example I use this:
User ${foreach backlog message}${message.fields.username}${end} connected to switch ${foreach backlog message}${message.source}${end} from IP ${foreach backlog message}${message.fields.src_ip}${end}