When Auditbeat is initially started with the file_integrity module enabled, all files within the monitored paths are logged with created status - which is in some cases not preferred.

scan_at_start: false works, but can be insecure as no changed will be logged if you restart Auditbeat and a file is modified while the application is not running.

This is a feature request for the option to either prevent the sending of this initial data, and/or adding a flag to the records to indicate the data was generated on the applications initial start.

Let me know if there is any additional information that would be helpful here!

/cc @andrewkroh @strawgate