{
            "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
            "contentVersion": "1.0.0.0",
            "metadata": {
              "_generator": {
                "name": "bicep",
                "version": "0.8.9.13224",
                "templateHash": "10168684702963472338"
              }
            },
            "parameters": {
              "dataCollectionRuleName": {
                "type": "string",
				"defaultValue": "CommonSecurityLogDCR"
              },
              "location": {
                "type": "string",
				"defaultValue": "[resourceGroup().location]"

              },
              "workspaceName": {
                "type": "string"
              },
              "endpointResourceName": {
                "type": "string"
              }
            },
            "resources": [
              {
                "type": "Microsoft.Insights/dataCollectionRules",
                "apiVersion": "2021-09-01-preview",
                "name": "[parameters('dataCollectionRuleName')]",
                "location": "[parameters('location')]",
                "properties": {
                  "dataCollectionEndpointId": "[resourceId('Microsoft.Insights/dataCollectionEndpoints', parameters('endpointResourceName'))]",
                  "streamDeclarations": {
                    "Custom-MyTableRawData": {
                      "columns": [
                        {
                          "type": "string",
                          "name": "SourceSystem"
                        },
                        {
                          "type": "datetime",
                          "name": "TimeGenerated"
                        },
                        {
                          "type": "string",
                          "name": "Computer"
                        },
                        {
                          "type": "datetime",
                          "name": "EventTime"
                        },
                        {
                          "type": "string",
                          "name": "Facility"
                        },
                        {
                          "type": "string",
                          "name": "HostName"
                        },
                        {
                          "type": "string",
                          "name": "SeverityLevel"
                        },
                        {
                          "type": "string",
                          "name": "SyslogMessage"
                        },
                        {
                          "type": "int",
                          "name": "ProcessID"
                        },
                        {
                          "type": "string",
                          "name": "HostIP"
                        },
                        {
                          "type": "string",
                          "name": "ProcessName"
                        },
                        {
                          "type": "string",
                          "name": "Type"
                        }
                      ]
                    }
                  },
                  "destinations": {
                    "logAnalytics": [
                      {
                        "workspaceResourceId": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.OperationalInsights/workspaces', parameters('workspaceName'))]",
                        "name": "clv2ws1"
                      }
                    ]
                  },
                  "dataFlows": [
                    {
                      "streams": [
                        "Custom-MyTableRawData"
                      ],
                      "destinations": [
                        "clv2ws1"
                      ],
                      "transformKql": "source",
                      "outputStream": "[parameters('outTable')]"
                    }
                  ]
                }
              }
            ],
            "outputs": {
              "dcrId": {
                "type": "string",
                "value": "[reference(resourceId('Microsoft.Insights/dataCollectionRules', parameters('dataCollectionRuleName'))).immutableId]"
              }
            }
          }