[Auditbeat] scanner honor include_files (#27722)

* [Auditbeat] scanner honor include_files

- If included_path is set and file is not an included path then it is
  skipped
- directories are included even if they don't match included path
  because the contents might
- change test regex to work on linux, mac and windows

Closes #27273

CHANGELOG.next.asciidoc

@@ -217,6 +217,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - system/package: Fix an error that can occur while trying to persist package metadata. {issue}18536[18536] {pull}18887[18887]
 - system/socket: Fix dataset using 100% CPU and becoming unresponsive in some scenarios. {pull}19033[19033] {pull}19764[19764]
 - system/socket: Fixed tracking of long-running connections. {pull}19033[19033]
+- file_integrity: honor include_files when doing initial scan. {issue}27273[27273] {pull}27722[27722]
 
 *Filebeat*
 

auditbeat/module/file_integrity/metricset_test.go

@@ -258,7 +258,7 @@ func TestIncludedExcludedFiles(t *testing.T) {
 	}
 
 	config := getConfig(dir)
-	config["include_files"] = []string{`\.ssh/`}
+	config["include_files"] = []string{`\.ssh`}
 	config["recursive"] = true
 	ms := mbtest.NewPushMetricSetV2(t, config)
 

auditbeat/module/file_integrity/scanner.go

@@ -140,6 +140,11 @@ func (s *scanner) walkDir(dir string, action Action) error {
 			}
 			return nil
 		}
+
+		if !info.IsDir() && !s.config.IsIncludedPath(path) {
+			return nil
+		}
+
 		defer func() { startTime = time.Now() }()
 
 		event := s.newScanEvent(path, info, err, action)