This way works as expected:
filebeat:
prospectors:
- paths:
- /var/log/test.log
input_type: log
document_type: testlog
close_renamed: true
exclude_lines: ['MYKEYWORD']
output:
file:
path: "/tmp"
filename: filebeat