diff --git a/skills/online-mining-v2/scripts/online_mining_common.py b/skills/online-mining-v2/scripts/online_mining_common.py
index 776aaf3..c117e5c 100644
--- a/skills/online-mining-v2/scripts/online_mining_common.py
+++ b/skills/online-mining-v2/scripts/online_mining_common.py
@@ -309,11 +309,17 @@ def fetch_session_turns(
 
     if not session_id or not before_timestamp:
         return []
-    filters = [
-        {"term": {"session_id.keyword": session_id}},
-        {"range": {"timestamp": {"lt": before_timestamp}}},
-    ]
-    docs = search_docs(source="main", date=date, size=max(limit * 3, limit), query_filters=filters)
+    docs: list[dict[str, Any]] = []
+    # arch-flat-nlp-log-f-* 里 session_id 在部分索引没有 .keyword 子字段，
+    # 所以必须先试 keyword，再兜底原字段。
+    for session_field in ("session_id.keyword", "session_id"):
+        filters = [
+            {"term": {session_field: session_id}},
+            {"range": {"timestamp": {"lt": before_timestamp}}},
+        ]
+        docs = search_docs(source="main", date=date, size=max(limit * 3, limit), query_filters=filters)
+        if docs:
+            break
     cases = [extract_main_case(doc) for doc in docs]
     cases = [
         case