According to these instructions, the disk queue should work with auditbeat.
beats/auditbeat/current/configuring-internal-queue.html
According to the documentation, the folder defined under path should be created when the service is started.
Even if the elastic host is no longer accessible, only the RAM is used as a queue.
I use Rocky Linux (9.4) and auditbeat (8.15) in the latest version.
Config example:
output.elasticsearch:
# Array of hosts to connect to.
hosts: ["xxx.xxx:9200/"]
# Performance preset - one of "balanced", "throughput", "scale",
# "latency", or "custom".
preset: balanced
# Protocol - either `http` (default) or `https`.
#protocol: "https"
# Authentication credentials - either API key or username/password.
#api_key: "id:api_key"
username: "auditbeat"
password: "xxxxx"
# Anzahl der Ereignisse pro Batch.
bulk_max_size: 2048
# Anzahl der Ereignisse pro Batch.
workers: 4
# ----------------------------------- Buffer -----------------------------------
#queue.mem:
# events: 4096
# flush.min_events: 512
# flush.timeout: 5s
queue.disk:
max_size: 10GB
path: "/var/lib/auditbeat/diskqueue"