Highlighting config json is working strangly

[ack-sprypoint]

lnav version
v0.13.2

Describe the bug
Some strings are being highlighted and others are not.

To Reproduce
Steps to reproduce the behavior:
config file ~/.lnav/configs/default/http-status-code.json

  "$schema": "https://lnav.org/schemas/config-v1.schema.json",
  "ui": {
    "theme-defs": {
      "default": {
        "highlights": {
          "5xx-errors": {
            "pattern": " 5[0-9][0-9] ",
            "style": {
              "color": "#ff0000"
            }
          },
          "4xx-errors": {
            "pattern": "4[0-9][0-9]",
            "style": {
              "color": "#ffff00"
            }
          },
          "2xx-success": {
            "pattern": " 2[0-9][0-9] ",
            "style": {
              "color": "#00ff00"
            }
          }
        }
      }
    }
  }
}

Test file testfile.log

Sep 23 02:05:33 test-server access.log: 111.111.111.111 - - [23/Sep/2025:09:05:33 +0000] "GET /healthz HTTP/1.1" 200 564 "-" "Mozilla/5.0 Chrome/129.0.0.0 Safari/537.36"
Sep 23 02:05:33 test-server access.log: 111.111.111.111 - - [23/Sep/2025:09:05:33 +0000] "GET /healthz HTTP/1.1" 500 564 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 (StatusCake)"
Sep 23 02:05:33 test-server access.log: 111.111.111.111 - - [23/Sep/2025:09:05:33 +0000] "GET /healthz HTTP/1.1" 500 564 "-" "Mozilla/5.0 Chrome/129.0.0.0 Safari/537.36"
Sep 23 02:05:33 test-server access.log: 111.111.111.111 - - [23/Sep/2025:09:05:33 +0000] "GET /healthz HTTP/1.1" 404 564 "-" 
Sep 23 02:05:33 test-server access.log: 111.111.111.111 - - [23/Sep/2025:09:05:33 +0000] "GET /healthz HTTP/1.1" 499 564 "-"                              "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/
Sep 23 02:05:33 test-server access.log: 111.111.111.111 - - [23/Sep/2025:09:05:33 +0000] "GET /healthz HTTP/1.1" 499 564 "-" "Mozilla/5.0 Chrome/129.0.0.0 Safari/537.36"
Sep 23 02:05:33 test-server access.log: 111.111.111.111 - - [23/Sep/2025:09:05:33 +0000] "GET /healthz HTTP/1.1" 201 564 "-" "Mozilla/5.0 Chrome/129.0.0.0 Safari/537.36"
Sep 23 02:05:33 test-server access.log: 111.111.111.111 - - [23/Sep/2025:09:05:33 +0000] "GET /healthz HTTP/1.1" 503  564 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 (StatusCake)"
Sep 23 02:05:33 test-server access.log: 111.111.111.111 - - [23/Sep/2025:09:05:33 +0000] "GET /healthz HTTP/1.1" 503 564 "-"
Sep 23 02:05:33 test-server access.log: 111.111.111.111 - - [23/Sep/2025:09:05:33 +0000] "GET /healthz HTTP/1.1" 502 564 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 (StatusCake)"


192.168.1.1 GET /test 500 error
192.168.1.1 GET /home 200 success
192.168.1.1 GET /missing 404 notfound

The following need to need 2 spaces after the status code to be highlighted:
192.168.1.1 GET /test 500  
192.168.1.1 GET /home 200  
192.168.1.1 GET /missing 404  

1 space and they don't work:
192.168.1.1 GET /test 500 
192.168.1.1 GET /home 200 
192.168.1.1 GET /missing 404 

lnav testlog.log

The command :highlight Regex-string seems to work as intended
doesn't matter how I change the the spaces around the regex or remove them entirely, the results are the same.

[tstack]

Thanks for the detailed report! It made it easy to replicate. There was a bug internally where the wrong value was being used for the size of the log message, so the highlight was not applied to stuff at the end of the message. That's why the line ending with 404 564 "-" was not highlighted at all.

The other issue is that the configuration surrounds the numbers with spaces. Currently, lnav doesn't want to overlap highlights. So, in the case where there are two numbers next to each other, the spaces at the start and end will overlap and only one number will be highlighted. One option would be to surround the numbers with \b. For example, "\\b5[0-9][0-9]\\b" instead of " 5[0-9][0-9] ". The \b means a word-break and is zero-width. The zero-width part is important so that there is no overlap. Another option would be to use negative lookahead/lookbehind.