We typically use last_activity_at and total_activity_time off of the enrollments table rather web_logs for student engagement questions. Instructure usually disclaims that web_logs is not guaranteed to be 100% accurate, shouldn't be used for individual-level auditing or academic integrity questions, etc. If you do use the enrollments data, a few things to think about:
1) You'll be dealing with course/section-level data rather than an absolute "last time this user shows up in web_logs" so you'll have to think about how to aggregate across courses. E.g., a student may have a last_activity_at of weeks ago in one course, but activity yesterday in another course. Does that mean they are non-engaged?
2) One way of trying to answer that is by averaging those measures across a course. Then you can see, for example, well every student in this class has a last_activity_at of several weeks ago so maybe the course just doesn't require much Canvas use. (Quite possible at our institution, may of course be different at yours.)
3) Combining last_activity_at and total_activity_time with other data points like missing assignments or submissions can give a fuller sense of (non-)engagement as well. But, the same caveat applies that you probably want to normalize those values across a course rather than just looking at absolutes. It's not out of the ordinary for one of our instructors, for example, to be using Canvas in a way where every student has multiple missing submissions but that is actually fine for their engagement and grade.