I would help to see actual records as well as the actual pattern you are using to extract data. Is it possible that the grok pattern is not working as you expect and that fielda and fieldb are not getting populated for all records? Do you see the expected number of records in the file input that is within the conditional?