Is this for Instant or for Controller?
Can you explain what the ultimate goal is, as having the logs for all APs under a controller or Instant VC usually makes more sense as the wireless system behaves like a single entity?
My syslog-ng is configured to log messages in a separate file by source IP, which is something trivial to set up:
source s_net { udp(port(514)); tcp(); tcp(port(10000)); };
destination d_remote { file("/var/log/remote/$HOST-$YEAR$MONTH$DAY.log"); };
log { source (s_net); destination (d_remote); };
With $HOST, it will take the host-name via reverse DNS when available or IP if it is not available. The $YEAR$MONTH$DAY results in a log file per day.