使用如下所示的测试文件：
[01:23:45] ERROR /foo/bar:42 - this is a log message
[01:23:45] ERROR /foo/bar:42 - this is a ERROR log message
[01:23:45] CRITICAL /foo/bar:42 - this is a log message
[01:23:45] CRITICAL /foo/bar:42 - this is a CRITICAL log message
此语法文件适用于我，不会在消息部分突出显示这些关键字。
" Match the beginning of a log entry. This match is a superset which
" contains other matches (those named in the "contains") parameter.
"
" ^ Beginning of line
" \[ Opening square bracket of timestamp
" [^\[\]]\+ A class that matches anything that isn't '[' or ']'
" Inside a class, ^ means "not"
" So this matches 1 or more non-bracket characters
" (in other words, the timestamp itself)
" The \+ following the class means "1 or more of these"
" \] Closing square bracket of timestamp
" \s\+ Whitespace character (1 or more)
" [A-Z]\+ Uppercase letter (1 or more)
"
" So, this matches the timestamp and the entry type (ERROR, CRITICAL...)
"
syn match logBeginning "^\[[^\[\]]\+\]\s\+[A-Z]\+" contains=logTime,logCritical,logError,logWarn,logInfo,logDebug
" A region that will match the timestamp. It starts with a bracket and
" ends with a bracket. "contained" means that it is expected to be contained
" inside another match (and above, logBeginning notes that it contains logTime).
" The "me" parameter e-1 means that the syntax match will be offset by 1 character
" at the end. This is usually done when the highlighting goes a character too far.
syn region logTime start=+^\[+ end=+\] +me=e-1 contained
" A list of keywords that define which types we expect (ERROR, WARN, etc.)
" These are all marked contained because they are a subset of the first
" match rule, logBeginning.
syn keyword logCritical CRITICAL contained
syn keyword logError ERROR contained
syn keyword logWarn WARN contained
syn keyword logInfo INFO contained
syn keyword logDebug DEBUG contained
" Now that we have taken care of the timestamp and log type we move on
" to the filename and the line number. This match will catch both of them.
"
" \S\+ NOT whitespace (1 or more) - matches the filename
" : Matches a literal colon character
" \d\+ Digit (1 or more) - matches the line number
syn match logFileAndNumber " \S\+:\d\+" contains=logFile,logLineNumber
" This will match only the log filename so we can highlight it differently
" than the line number.
syn match logFile " \S\+:" contained
" Match only the line number.
syn match logLineNumber "\d\+" contained
您可能会好奇为什么我不使用各种匹配，而是使用包含匹配。这是因为像\d\+ 这样的一些匹配太通用了，无法匹配行中的任何位置并且是正确的——使用包含的匹配，它们可以组合成更可能正确的模式。在此语法文件的早期版本中，一些示例行是错误的，例如，如果“ERROR”出现在该行后面的日志条目文本中，它将被突出显示。但是在这个定义中，这些关键字只有在它们旁边的时间戳旁边才匹配，该时间戳只显示在行的开头。所以容器是一种更精确匹配的方法，同时也可以控制正则表达式的长度和复杂性。
更新：根据您提供的示例行（如下所述），我改进了上面第一行的正则表达式，在我的测试中，它现在可以正常工作了。
[2015-10-05 13:02:27,619] ERROR /home/admusr/autobot/WebManager/wm/operators.py:2371 - Failed to fix py rpc info: [Errno 2] No such file or directory: '/opt/.djangoserverinfo'
[2015-10-05 13:02:13,147] ERROR /home/admusr/autobot/WebManager/wm/operators.py:3223 - Failed to get field "{'_labkeys': ['NTP Server'], 'varname': 'NTP Server', 'displaygroup': 'Lab Info'}" value from lab info: [Errno 111] Connection refused
[2015-10-05 13:02:38,012] ERROR /home/admusr/autobot/WebManager/wm/operators.py:3838 - Failed to add py rpc info: [Errno 2] No such file or directory: '/opt/.djangoserverinfo'
[2015-10-05 12:39:22,835] DEBUG /home/admusr/autobot/WebManager/wm/operators.py:749 - no last results get: [Errno 2] No such file or directory: u'/home/admusr/autobot/admin/branches/Wireless_12.2.0_ewortzman/.lastresults'