Together with HI support we found the right answer:

We can address directly the field name from the JSON object from additional_info field by ${source_link}. The rule checks first for field names in the em_alert table and if not found checks the additional_info JSON object for the same field name.