You have to setup number of backlog to 1: in Alerts - Event Definitions - tab Notifications and field Message Backlog, tick the checkbox and set 1.
Message backlog define number of messages to be included in Notifications.
If you want device source included in notification message use:
${foreach backlog message}${message.source}${end}
If you want to use user field (for example: srcip) use {$message.fields.srcip} :
${foreach backlog message}${message.fields.src_ip}${end}
For example I use this message text after somebody connect to switch:
{foreach backlog message} Source device: {message.source} Username: {message.fields.username} IP: {message.fields.srcip} ${end}
You can also use same technique in message subject, for example I use this:
User ${foreach backlog message}${message.fields.username}${end} connected to switch ${foreach backlog message}${message.source}${end} from IP ${foreach backlog message}${message.fields.src_ip}${end}
Hope it helps.