This template creates a data collection rule defining the data source (Syslog) and the destination workspace.
{"name": "[parameters('actiongroupname')]", "type": "microsoft.insights/actiongroups", "apiversion": "2019-06-01", "location": "global", "properties": {"groupshortname": "[parameters('actiongroupshortname')]", "enabled": true, "emailreceivers": [{"name": "test", "emailaddress": "[parameters('emails')[0]]", "usecommonalertschema": true}]}} 