Function extract_timestamp 

pub fn extract_timestamp(json: &Value) -> Option<DateTime<Utc>>

Extract timestamp from a JSON record. Supports both CLI format (timestamp) and Desktop format (_audit_timestamp).