When configuring the fields for the send email action (and really any action) you need to match the event from the correlation to the action. For example, in the Continuous Excessive Logon Failures rule, the correlated event is UserLogonFailure.
So all of your e-mail templates need to include UserLogonFailure. This is what tells the LEM where to grab the information from (which fields in the event) to plug into your e-mail template. You can see a KB article that discusses a similar issue and screenshots a correct send e-mail action here:
If you're under active maintenance on the product (or any SolarWinds product really) you may want to set some time aside to attend the LEM intro course: