Sonar exclusions (like other sonar properties) have to be added to the <properties>
section of the POM file. Like so (example from excluding jOOQ autogenerated code from current project):
<properties>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<sonar.host.url>http://www.example.com/</sonar.host.url>
<sonar.jdbc.url>jdbc:postgresql://www.example.com/sonar</sonar.jdbc.url>
<sonar.jdbc.driver>org.postgresql.Driver</sonar.jdbc.driver>
<sonar.jdbc.username>sonar</sonar.jdbc.username>
<sonar.jdbc.password>sonar</sonar.jdbc.password>
<sonar.exclusions>org/binarytherapy/generated/**/*, **/GuiceBindComposer.java</sonar.exclusions>
<sonar.dynamic>reuseReports</sonar.dynamic>
</properties>