The original topic:  https://community.tp-link.com/en/business/forum/topic/506136  is locked for replies however I found a workaround for this on rsyslog.

In order to get an actual filename for the log instead of just .log I did the following in my /etc/rsyslog.conf

# provides UDP syslog reception
module(load="imudp")
input(type="imudp" port="514")
$AllowedSender UDP, 127.0.0.1, 192.168.1.0/24

# provides TCP syslog reception
module(load="imtcp")
input(type="imtcp" port="514")
$AllowedSender TCP, 127.0.0.1, 192.168.1.0/24
#Templates for incoming logs
$template Incoming-logs,"/var/log/%HOSTNAME%/%PROGRAMNAME%.log"
$template OC200,"/var/log/%HOSTNAME%/OC200.log"

#Set Template for OC200 incoming logs, if not from the OC200 then use normal filename. 
if $hostname contains 'your_contoller.hostname' or $fromhost-ip== '192.168.1.xxx'then {
  *.* ?OC200
} else {
  *.* ?Incoming-logs
}

Hope this helps anyone else out there. If no hostname is set in DNS for your controller, it goes to /var/log/192.168.1.xxx/OC200.log

I am sure this can be adapted to your own setups.