swipely-sumo-logic-blog-post-example-02.rb

require 'aws-sdk'
require 'sumo'
require 'time'

# get all instances that have sent logs in last hour
sumo_insts = Sumo.search(
  query: 'instance_id | parse "\"instance_id\":\"*\"" as instance_id | count by instance_id',
  from: (Time.now - (60 * 60)).iso8601,
  to: Time.now.iso8601,
  time_zone: 'UTC'
).records.map { |record| record['instance_id'] }

# get all EC2 instances
ec2_insts = AWS::EC2.new.instances.map { |inst| inst.id }

# find the non-reporting instances
non_reporting_insts = ec2_insts - sumo_insts