Is it possible to use just some parts of syslog message to be presented in "Alarm message" ?

Syslog message is very big and I want to show just some info from it.

So instead "$message" is there any other switch to use ?

thnx,