[Metricbeat][System]`system.process.state` reports `sleeping`

Version: 8.12

Description of the problem including expected versus actual behavior: Various users have surfaced that processes show as 'sleeping' within the Host 'processes' view which is leading to customers not trusting the 'processes' functionality offered by Elastic.

Example customer issue Example customer issue

It seems that the majority of processes are reporting as 'sleeping':

Discover - breaking down processes by state (demo cluster)

Host processes (demo cluster)

Could we confirm:

• What 'sleeping' means? The UI just looks at the system.process.state field
• How is it calculated?
• Is this working correctly? e.g. are most processes expected to show as 'sleeping'?

Steps to reproduce:

1. Spin up a host
2. Deploy Elastic Agent (or metricbeat)
3. Check the process.state fields being emitted in Discover (or the host experience)

Note : We'll try and get some direct customer feedback to help debug this