...
The IF expression is basically any arbitrary Perl expression, but tokens of the form event.name or node.name are substituted with the respective event or node property value. The special wildcards event.any and node.any are replaced by a logical true value. Furthermore, tokens that match extdb.queryname.column will be substituted with the result of an external enrichment query.
The substituted values are inserted into the expression in double quotes. In versions 2.0.4 and above, the special characters @%$"` are backslash-escaped to ensure that Perl does not interpret them when the expression is evaluated. In version 2.0.4 and above, purely numeric values are inserted unquoted as they are; before they were inserted double-quoted like strings.
The standard event properties are listed on this page, and the common node properties are documented here.
...
Thus, to send event emails to contact xyz with email address abc@def.com, you have to specify the action as email(xyz), and add a contact section for xyz (with email abc@...) to Contacts.nmis.
Please note that before version 2.0.4 email actions were handled synchronously and thus blocked the events processing until the email delivery concluded. In version 2.0.4 and newer this action is handled asynchronously in a separate process.
Configuration for syslog.XYZ() and nmissyslog.XYZ()
...