I found this from the documentation Filebeat Prospectors | Filebeat Reference [5.5] | Elastic
If multiline is also specified, each multiline message is combined into a single line before the lines are filtered by
exclude_lines.
This is an open issue .Please take a look. Filebeat exclude_lines prior to multiline · Issue #1940 · elastic/beats · GitHub