Scrolling output with ccze
ccze uses the
curses output mode by default.
(n)curses is a screen drawing library typically used by fullscreen applications. It switches to the terminal emulator's so-called "alternate screen" which does not have a scrollbar buffer, and the contents of the other, "normal screen" is restored upon exit.
Instead of this, you should use its
ansi output format which is enabled by any of the
-m ansi or
--mode=ansi command line options.
less to scroll into logs:
ccze -A /var/log/logstash/logstash-plain.log | less -R