diff --git a/conf.d/11-firewall.conf b/conf.d/11-firewall.conf
index 6e276a91c511b26f0e02d9caa19b8743a2fb4237..e57e1bb262435cfca4bd6c75dec72456b3d1b595 100644
--- a/conf.d/11-firewall.conf
+++ b/conf.d/11-firewall.conf
@@ -52,12 +52,12 @@ filter {
         geoip {
           add_tag => [ "GeoIP" ]
           source => "[source][ip]"
-          database => "/etc/logstash/GeoLite2-City.mmdb"
+          database => "/usr/share/GeoIP/GeoLite2-City.mmdb"
           target => "[source][geo]"
         }
         geoip {
          default_database_type => 'ASN'
-         database => "/etc/logstash/GeoLite2-ASN.mmdb"
+         database => "/usr/share/GeoIP/GeoLite2-ASN.mmdb"
          #cache_size => 5000
          source => "[source][ip]"
          target => "[source][as]"
@@ -79,12 +79,12 @@ filter {
         geoip {
           add_tag => [ "GeoIP" ]
           source => "[destination][ip]"
-          database => "/etc/logstash/GeoLite2-City.mmdb"
+          database => "/usr/share/GeoIP/GeoLite2-City.mmdb"
           target => "[destination][geo]"
         }
         geoip {
          default_database_type => 'ASN'
-         database => "/etc/logstash/GeoLite2-ASN.mmdb"
+         database => "/usr/share/GeoIP/GeoLite2-ASN.mmdb"
          #cache_size => 5000
          source => "[destination][ip]"
          target => "[destination][as]"