There are three ways of defining syntax items (see :help :syn-define):
- Keywords: these are for items that are simple strings of keyword characters. This is the fastest matcher.
- Matches: these are regular expressions for matching.
- Regions: these are for long regions that are likely to contain other items.
There are various arguments that make things more complicated (to do with matches within regions etc), see :help :syn-arguments for a discussion of this.
There is a priority that comes into effect (see :help :syn-priority).
Colouring is controlled by the highlight command and is separate to the syntax commands.
A simple way to get started would be to use a match to detect the date and a keyword to detect error. Then use highlight to make the colours come to life:
" This creates a keyword ERROR and puts it in the highlight group called logError
:syn keyword logError ERROR
" This creates a match on the date and puts in the highlight group called logDate. The
" nextgroup and skipwhite makes vim look for logTime after the match
:syn match logDate /^\d\{4}-\d\{2}-\d\{2}/ nextgroup=logTime skipwhite
" This creates a match on the time (but only if it follows the date)
:syn match logTime /\d\{2}:\d\{2}:\d\{2},\d\{3}/
" Now make them appear:
" Link just links logError to the colouring for error
hi link logError Error
" Def means default colour - colourschemes can override
hi def logDate guibg=yellow guifg=blue
hi def logTime guibg=green guifg=white
Bung all of that in ~/.vim/syntax/log.vim and make sure the file type is set properly (see :help filetype.txt) – it should then load automatically.
Hopefully that should give you something to get going with. Have a (very gradual) read of the various sections of :help syntax.txt and :help usr_44.txt for further info.