diff --git a/xiaoqu-agent-service/src/main/java/me/iiv/agent/es/PaperUseLogEsGatewayImpl.java b/xiaoqu-agent-service/src/main/java/me/iiv/agent/es/PaperUseLogEsGatewayImpl.java
index a1b182c..5c69d6f 100644
--- a/xiaoqu-agent-service/src/main/java/me/iiv/agent/es/PaperUseLogEsGatewayImpl.java
+++ b/xiaoqu-agent-service/src/main/java/me/iiv/agent/es/PaperUseLogEsGatewayImpl.java
@@ -53,8 +53,10 @@ public class PaperUseLogEsGatewayImpl implements PaperUseLogEsGateway {
             body.put("track_total_hits", false);
             ObjectNode bool = body.putObject("query").putObject("bool");
             bool.set("filter", filters);
+            // rfid 是 text 类型（mapping 含 ignore_above=256 的 keyword 子字段），terms 聚合必须用 rfid.keyword，
+            // 直接聚合 text 字段报 "Text fields are not optimised for ... aggregations"（400，生产实测）
             body.putObject("aggs").putObject("rfids").putObject("terms")
-                    .put("field", "rfid").put("size", RFID_TERMS_SIZE);
+                    .put("field", "rfid.keyword").put("size", RFID_TERMS_SIZE);
 
             Request req = new Request("POST", "/" + index + "/_search");
             req.setJsonEntity(mapper.writeValueAsString(body));