There is already an open issue for that here: https://github.com/elastic/beats/issues/1940 Currently exclude_lines is a processor and multiline is a reader. Processors are only applied after the reader finished. It would required some reorganisation. Happy to hear some suggestions on how could solve this issue.