The way is implemented at the moment is that include_lines is called before exclude_lines. The idea was to be able to include Apache logs but exclude the debug messages coming from Apache by setting:
include_lines: ['apache']
exclude_lines: ['^DBG']