Set the mode to command then you just treat the output as if it were a file.
Then set up your watchers to match everything that should be in the file with the option "abort on match" set.
Then set up a final watcher that matches everything /.*/ for your "otherwise' alarm.
So you'd have 3 watchers based on the output you provided - the order displayed is important since they are evaluated sequentially from top to bottom
One that matches /.*?ora.LISTENER_SCAN2.lsnr.*/ and doesn't result in an error and has abort on match set
One that matches /.*?ONLINE.*/ and clears the error and has abort on match set
One that matches /.*/ and sets the error
As an alternative you can change your command to
crsctl status res -t | grep -A 1 LISTENER_SCAN2 | grep "ONLINE" | wc -l
the wc (word count, -l = lines) will report the number of ONLINE lines selected - so you'll get a 0 if none which is your error case and 1 (or more) for the OK case
-------------------------------------------