Off the top of my head something like this
(?i)java.lang.Exception:\s?<field>(.+)$
This works for my data (YMMV) at search time:
"java.lang.Exception" | rex field=_raw "(?ms)java.lang.Exception(?P<exception>.+)"
add (?ms) on the beginning - the s is dotall, and the m is multi-line.
(?ms)java.lang.Exception:\s?<field>(.+)
its multiline event
Is that the entire event? I ask because of the mis-matched paren. Is it a single-line or multi-line event?