I have (long-running) processes that have a starting, running and shutdown phase. I want to filter logs to only show the running phase. I looked at ECS and found service.state
as a field that might be suitable, however, there aren't any valid values documented.
Is this what I should use? Are there any standard values? Any good alternative field that could fit?