Looks like the WordPress code has changed since the last answer to this question was posted. The current wp_debug_mode() function related to those constants includes a test for whether WP_DEBUG_LOG equates to true or 1 -- in which case it behaves as others have described it.
However, you can also set that constant to a string -- your preferred file path -- and the log will be output there. For example, you can set it to a path outside of your directories for publicly accessible web content. You may have to play with file permissions to get that to work.
I came looking for this answer because the WordFence security plugin is complaining about my debug log being potentially accessible in /wp-content/
if ( in_array( strtolower( (string) WP_DEBUG_LOG ), array( 'true', '1' ), true ) ) {
$log_path = WP_CONTENT_DIR . '/debug.log';
} elseif ( is_string( WP_DEBUG_LOG ) ) {
$log_path = WP_DEBUG_LOG;
} else {
$log_path = false;
}