set timestamp with capture loss

salt/telegraf/scripts/zeekcaptureloss.sh

@@ -1,7 +1,10 @@
 #!/bin/bash
+# This script returns the average of all the workers average capture loss to telegraf / influxdb in influx format include nanosecond precision timestamp
 {%- set WORKERS = salt['pillar.get']('sensor:zeek_lbprocs', salt['pillar.get']('sensor:zeek_pins') | length) %}
 ZEEKLOG=/host/nsm/zeek/spool/logger/capture_loss.log
 if [ -f "$ZEEKLOG" ]; then
   LOSS=$(tail -{{WORKERS}} $ZEEKLOG | awk -F, '{print $NF}' | sed 's/}//' | awk -F: '{LOSS += $2 / {{WORKERS}}} END { print LOSS}')
-  echo "zeekcaptureloss loss=$LOSS"
-fi
+  TS=$(tail -1 $ZEEKLOG | jq .ts | sed 's/"//g')
+  TSNANO=$(echo "$(date -d "$TS" +"%s.%N") 1000000000 * p" | dc | awk -F. {'print $1'})
+  echo "zeekcaptureloss loss=$LOSS $TSNANO"
+fi

salt/telegraf/scripts/zeekloss.sh

@@ -1,4 +1,5 @@
 #!/bin/bash
+# This script returns the packets dropped by Zeek, but it isn't a percentage. $LOSS * 100 would be the percentage
 ZEEKLOG=$(tac /host/nsm/zeek/logs/packetloss.log | head -2)
 declare RESULT=($ZEEKLOG)
 CURRENTDROP=${RESULT[3]}