Valid values for service.state

I have (long-running) processes that have a starting, running and shutdown phase. I want to filter logs to only show the running phase. I looked at ECS and found service.state as a field that might be suitable, however, there aren't any valid values documented.

Is this what I should use? Are there any standard values? Any good alternative field that could fit?

Hi @kelunik,

I can't find any specification for that in ECS or OpenTelemetry. Looking at the usage of the fields by the official integrations I see "UP" and "DOWN" as possible values, but to me it also sounds reasonable for the states you mentioned.