Looks like you should use the UserLogonFailure fields (what's in your "Correlations" box) instead of the FailedAuthentication fields. That should fix it.
Is this is trick question?
Look like you are using UserLogonFailure in the correlation, but FailedAuthentication to populate the email message.
The fields in the email must appear in the correlation.