That sounds good. It might be a good idea to exclude 'compute.instance.exists' events from the query while populating InstanceUsage since the exists that gets sent for a given request represents the past state of the instance.