If I'm understanding your question correctly, you can't.
If you're goal (as an example) is to say monitor for device.type AND msg.id to look for specific events not coming it doesn't work that way. Someone can correct me if I'm wrong, but essentially the ESM is pulling only a specific few targeted meta (collector, device.ip, device.type) stats from all your LDs and using it for notification if something stops logging (I'm guessing it's using the LD's built in stats collection functionality as it already collects stats on that meta).
You could try, but it might not work and might cause other problems, creating a additional device.type meta value based on an app rule that includes all the meta you're looking for but those events would now have two pieces of device.type meta and I'm not sure how that would affect the stats collection, your ESA rules, warehouse reporting, etc
If you have ESA you can setup an alert and do some window batching to look for zero events. I wish you could setup a report alert to run on a specific schedule. For example if you could have a report alert run every 1 or 4 hours and have rule that only has data by using max_threshold to filter out values > 0 or whatever you consider to be the low count.
