How to extract the time stamp from

Add add_tag => [ "randomText" ] to the grok filter and check whether the document ends up having that tag. That will tell you whether the grok is executing.