title: awk: Counting errors in tomcat logs
body: <p>My Tomcat logs are build in this format:</p>
  
  <pre><code>[&lt;DATE&gt;] [&lt;COMPONENT&gt;] ERROR_TYPE &lt;ERROR_NAME&gt; - &lt;Rest of line&gt;
  </code></pre>
  
  <p>Where <code>ERROR_TYPE</code> is <a href="http://logging.apache.org/log4j/1.2/apidocs/org/apache/log4j/Level.html" rel="nofollow">a log4j value</a> like <code>DEBUG</code> or <code>ERROR</code>. </p>
  
  <p>e.g.,</p>
  
  <pre><code>[18/Jul/2012:08:53:39 +0000] [component1] ERROR ConnectionTimeOut - ...
  [18/Jul/2012:09:54:32 +0000] [component2] DEBUG IPNotFound - ...
  [18/Jul/2012:09:54:32 +0000] [component1] TRACE Connected - ...
  [18/Jul/2012:08:53:39 +0000] [component1] ERROR ConnectionTimeOut - ...
  </code></pre>
  
  <p>I would like to create a maps from the tuple <code>(ERROR_TYPE, ERROR_NAME)</code> to the number of occurrences, e.g.</p>
  
  <pre><code>ERROR ConnectionTimeOut       2
  DEBUG IPNotFound              1
  TRACE Connected               1
  </code></pre>
  
  <p>How do I match something like:</p>
  
  <pre><code>_anything_ (ERROR|DEBUG|TRACE|WARN|FATAL_spaces_ _another_word_)_anything_
  </code></pre>
  
  <p>in AWK, and return only the part in parentheses?</p>