This template creates a data collection rule defining the data source (Syslog) and the destination workspace.
{"type": "microsoft.insights/actiongroups", "apiversion": "2019-06-01", "name": "[parameters('actiongroupname')]", "location": "global", "properties": {"groupshortname": "[parameters('actiongroupshortname')]", "enabled": true, "emailreceivers": [{"name": "emailreceiver", "emailaddress": "[parameters('emailaddress')]"}]}} 