diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
index 580f85a35e3..c38eeb659e7 100644
--- a/CHANGELOG.next.asciidoc
+++ b/CHANGELOG.next.asciidoc
@@ -143,6 +143,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - system/package: Fix an error that can occur while trying to persist package metadata. {issue}18536[18536] {pull}18887[18887]
 - system/socket: Fix dataset using 100% CPU and becoming unresponsive in some scenarios. {pull}19033[19033] {pull}19764[19764]
 - system/socket: Fixed tracking of long-running connections. {pull}19033[19033]
+- file_integrity: honor include_files when doing initial scan. {issue}27273[27273] {pull}27722[27722]
 
 *Filebeat*
 
diff --git a/auditbeat/module/file_integrity/metricset_test.go b/auditbeat/module/file_integrity/metricset_test.go
index aad49679c49..14522bcd627 100644
--- a/auditbeat/module/file_integrity/metricset_test.go
+++ b/auditbeat/module/file_integrity/metricset_test.go
@@ -258,7 +258,7 @@ func TestIncludedExcludedFiles(t *testing.T) {
 	}
 
 	config := getConfig(dir)
-	config["include_files"] = []string{`\.ssh/`}
+	config["include_files"] = []string{`\.ssh`}
 	config["recursive"] = true
 	ms := mbtest.NewPushMetricSetV2(t, config)
 
diff --git a/auditbeat/module/file_integrity/scanner.go b/auditbeat/module/file_integrity/scanner.go
index 6a960065d1c..a4bf7277633 100644
--- a/auditbeat/module/file_integrity/scanner.go
+++ b/auditbeat/module/file_integrity/scanner.go
@@ -140,6 +140,11 @@ func (s *scanner) walkDir(dir string, action Action) error {
 			}
 			return nil
 		}
+
+		if !info.IsDir() && !s.config.IsIncludedPath(path) {
+			return nil
+		}
+
 		defer func() { startTime = time.Now() }()
 
 		event := s.newScanEvent(path, info, err, action)