Use extracted field (username) in email address for alerts notification

We have an extractor to extract the username for failed authentications on our samba DCs. I would lik to setup an Alert, that notifies the user in question that more than X failed authentications have occurred for his/her account.

However, it appears to be impossible to setup an Alert to an email address containing a variable, like: $extracted_username@company.com, since $extracted_username is never replaced with the actual extracted username. It seems the email address is treated like something static.

I would be nice to be able to do that.

While we are running an older version (2.4), on the forum I have been informed that also the latest version does not do this.