It would be possible to address source compatibility with syslog and nt event logging here. What is in the scope and what is not. The idea is to build a minimum set of semantics, whether it's based on tags or position dependant fields or any other scheme may still be discussed. It should take this into account. Vendors could migrate toward using it without breaking existing logging infrastructure.
Message integrity is important.
Confidentiality might be important. SASL solve none of the requirements. IPsec doesn't either. It's not true that there is no standard. But syslog IS the problem.