I can try to help you out. But first, if you're on a the leading edge of Kibana releases you could try using Alerting instead of Watcher. The Alerting interface is Beta in the latest 7.9.2 release.
But for now, I'll focus on Watcher. First you need to know the query to trigger your watch.
If I have some test data with a field named my_int which only has some values between 0 and 3.
If I want to find docs which DON'T have this field, then in Discover I could put this in the query bar;
not my_int: * (which means find docs where this field doesn't exist)
If I want to find docs where the value is between 1 and 2 (like your 0 through 9) I could do;
my_int> 0 and my_int < 3 or my_int>= 1 and my_int <= 2
Combining those I could use (my_int>= 1 and my_int <= 2) or not my_int : *
But that is in the KQL query language and we can't use that in our watch. So if we use the "Inspect" menu in Kibana we can see the actual query "Request". This is what Kibana is sending to Elasticsearch but It could almost certainly be simplified. You could take your query to the Kibana Dev Tools Console to test it.
"query": {
"bool": {
"must": [],
"filter": [
{
"bool": {
"should": [
{
"bool": {
"filter": [
{
"bool": {
"should": [
{
"range": {
"my_int": {
"gte": 1
}
}
}
],
"minimum_should_match": 1
}
},
{
"bool": {
"should": [
{
"range": {
"my_int": {
"lte": 2
}
}
}
],
"minimum_should_match": 1
}
}
]
}
},
{
"bool": {
"must_not": {
"bool": {
"should": [
{
"exists": {
"field": "my_int"
}
}
],
"minimum_should_match": 1
}
}
}
}
],
"minimum_should_match": 1
}
},
{
"range": {
"@timestamp": {
"gte": "2020-10-19T01:01:00.000Z",
"lte": "2020-10-19T01:01:05.000Z",
"format": "strict_date_optional_time"
}
}
}
],
"should": [],
"must_not": []
}
Once you know the query you'll run, just follow the steps in our docs to create the watch. https://www.elastic.co/guide/en/kibana/current/watcher-ui.html#watcher-create-advanced-watch
In that advanced watch, look for the "query" and put your query there.
Let us know if you have more questions.
Lee