vim syntax: how to use contained fields - vim

Question

Following up on this question
The syntax of my logs has changed. I now have to include a username before the time, so the new format is:
[username] time LEVEL filepath:line - message
I have no problem defining the various regions:
syn region logUser start=+^\[+ end=+\] +me=e-1 contained
syn match logTime "\d\{4}-\d\{2}-\d\{2} \d\{2}:\d\{2}:\d\{2},\d\{3}" contained
syn keyword logCritical CRITICAL contained
syn keyword logError ERROR contained
syn keyword logWarn WARN contained
syn keyword logInfo INFO contained
syn keyword logDebug DEBUG contained
syn match logFileAndNumber " \S\+:\d\+ - " contains=logFile,logLineNumber
syn match logFile " \S\+:" contained
syn match logLineNumber "\d\+" contained
The problem is I can't figure out how to create a region at the beginning, so that I don't get highlighting any time I see one of the log levels, or if a timestamp appears in the message or something. The answer to the linked question works for the previous format, but doesn't have much in the way of explanation so I don't really understand what it's doing.
EDIT: Is there no way to simply define the smaller regions and then define the larger region as a sequence of the smaller ones? I know this wouldn't work, but something along the lines of:
syn match logBeginning "$logUser $logTime [$logCritical|$logError|$logWarn|$logInfo|$logDebug]"

Answer 1

If the sequence (user, time, severity, ...) is fixed, you can use nextgroup=... attribute to chain them together. So, make the first (logUser) an uncontained one (so that it matches anywhere), and instruct Vim to check for logTime after it (only followed by whitespace). All other groups are contained to avoid matches elsewhere.
syn region logUser start=+^\[+ end=+\] +me=e-1 nextgroup=logTime skipwhite
syn match logTime "\d\{4}-\d\{2}-\d\{2} \d\{2}:\d\{2}:\d\{2},\d\{3}" contained nextgroup=logCritical,logError,logWarn,logInfo,logDebug skipwhite
...
Cp. :help :syn-nextgroup.