Scrolling output with ccze

ccze uses the curses output mode by default. (n)curses is a screen drawing library typically used by fullscreen applications. It switches to the terminal emulator's so-called "alternate screen" which does not have a scrollbar buffer, and the contents of the other, "normal screen" is restored upon exit.

Instead of this, you should use its ansi output format which is enabled by any of the -A, --raw-ansi, -m ansi or --mode=ansi command line options.

I use ccze with less to scroll into logs:

ccze -A /var/log/logstash/logstash-plain.log | less -R