I don't think this is possible right now, but the easiest solution so make your first regexp long so it matches all lines except the one with "EXCEPTION". Potentially things like this can be done with the more advanced filters in 5.0.0: https://www.elastic.co/guide/en/beats/filebeat/master/configuration-filter.html