Variable expansion in Apache2 log file request based

I'd like to have custom log files for every user accessing a virtual host. The user name is present in environment-variable "SSL_CLIENT_S_DN_CN" (coming from client certificate authentication). So first I tried something like

 CustomLog /var/log/apache2/by_user/%{SSL_CLIENT_S_DN_CN}x.log \
      "%t %h %{SSL_CLIENT_S_DN_CN}x %{SSL_PROTOCOL}x %{SSL_CIPHER}x %H \"%r\" %b"

which obviously does not work since the log module does not expand the variable in the file path by itself.

My problem is similar to this here, but I need substitution request-based, not just once when Apache loads the site config.

mod_macro only seems to do the expansion once when the config is loaded, so this approach doesn't solve my problem.

I also tried doing the log-creation in an external script (logtest) using the "log pipe" feature, but this leads to an "error in condition clause":

CustomLog "|/usr/local/bin/logtest" "/var/log/apache2/by_user/%{SSL_CLIENT_S_DN_CN}x.log" \
"%t %h %{SSL_CLIENT_S_DN_CN}x %{SSL_PROTOCOL}x %{SSL_CIPHER}x %H \"%r\" %b"

Is it possible to get something like the macros being executed for every single request, so that I could create separate log files for every user?

EDIT:

I have a temporary solution now using "piped logs" like this:

apache site conf:

CustomLog "|/usr/local/bin/apache_logger" "%t %h %{SSL_CLIENT_S_DN_CN}x %{SSL_PROTOCOL}x %{SSL_CIPHER}x %H \"%r\" %b"

bash script located at /usr/local/bin/apache_logger:

#!/bin/bash

while read STDIN
do

  # format: [TIMESTAMP] IP USERNAME TLS CYPHER PROTOCOL "REQUEST" SIZE
  TIMESTAMP=$(echo "$STDIN" | cut -d" " -f1-2)
  IP=$(echo "$STDIN" | cut -d" " -f3)
  USER=$(echo "$STDIN" | cut -d" " -f4)
  TLS=$(echo "$STDIN" | cut -d" " -f5)
  CYPHER=$(echo "$STDIN" | cut -d" " -f6)
  PROTOCOL=$(echo "$STDIN" | cut -d" " -f7)
  REQUEST=$(echo "$STDIN" | cut -d" " -f8-10)
  SIZE=$(echo "$STDIN" | cut -d" " -f11)

  echo "$TIMESTAMP $IP $USER $TLS $CYPHER $PROTOCOL $REQUEST $SIZE" >> /var/log/apache2/by_user/$USER.log

done
exit 0

This seems to work as expected for now. Still it would be great if this could be done without the need of expensive external script calls.