Let me explain with an example:

From the above JSON representation, %parm[all]% covers ONLY the parameters array. If you want another event field like logmsg, description, etc. you need a different placeholder. Makes sense ?

It seems like you're expecting the wrong thing from %parm[all]%. That will just write ONLY the event parameters on a key=value format for each of them. The logMsg is not an event parameter.

The nodeDown is easy, but keep in mind that you can generate any event with send-event.pl or ReST, so it doesn't have to be real

I just picked an event which I can easily trigger. Shutting a node down is simple I guess I would been run into this "issue" with other events, too.

Since every default event like  nodeDown, nodeLostService but also custom events or threshold events have a logmsg field,  I've expected that I can use it with parm[variables] everywhere and all the time. I didn't know that there are differences.

In my case I wanted to create notifications for Slack. Of course I could create a notification with all texts I want to have (in subject or body). But since the event itself which is used to trigger a notification, has already handy information like logsmsg or description content, it would be very handy to be able to pipe them into a notification. Instead of rewriting new subjects/descriptions etc.

There is nothing wrong with the code; it should work, and in fact, it is working (keep reading).

Here is how the text message is extracted from the notification definition:

https://github.com/OpenNMS/opennms/blob/opennms-22.0.2-1/opennms-services/src/main/java/org/opennms/netmgt/notifd/BroadcastEventProcessor.java#L749

On the same method (like 754), you can see that the message is then expanded according with the incoming event through the implementation of the EventUtil interface here:

https://github.com/OpenNMS/opennms/blob/opennms-22.0.2-1/opennms-services/src/main/java/org/opennms/netmgt/notifd/BroadcastEventProcessor.java#L793

And, here is the implementation of the EventUtil interface:

https://github.com/OpenNMS/opennms/blob/opennms-22.0.2-1/features/events/daemon/src/main/java/org/opennms/netmgt/eventd/AbstractEventUtil.java#L767

That being said, you've chosen a wrong event, because the only parameter available on a nodeDown event is the node label. Please try an SNMP trap or a threshold event, and you should see all of them (i.e. find an event with more than one parameter).

Before what? Ever?

I'm pretty sure I've used parm[all] in past.