From experience, there's a nontrivial intersection between the BI stack and the operative administration stack.

However, in the difference, the admin stack with ELK, Riemann, Graphite, InfluxDB, Airbrake, Icinga and whatever else assumes that 30% of the information right now is worth more than 100% of the information 3 weeks later. You know, my application port is closed, first level support is getting hell, I need any available information right now.

On the other hand, the full data warehouse/tableau stack assumes that 100% of the information is more valuable than anything else. Good DWH-Guys and their analysts can do very awesome data voodoo, predictions and analysis, and the admin stack won't be able to reproduce most of that. It just takes 2 month of data collection and 2 - 3 weeks of analysis to get the result of that grand voodoo. And Tableau can automate that voodoo after it's been done once.

Tableau is for business analysts. ELK is for Sys Admins. I think.

Tableau is for business analysts. Splunk is for Sys Admins. ELK is for engineers with a lot of patience.

The ELK stack is really fancy next generation "tail -f | grep" in a web browser. Which is awesome and really important, but a very different problem from "tell me how many users have used my app for three or more days in a sliding thirty day window".

I've been eyeing a switch to the ELK stack from Mixpanel + Big Query for an app. Could you expand on what ELK is useful for?

At work we use it for log aggregation (specifically application-health telemetry from a mobile application). Very useful in debugging.

Oh god, don't do it. Running E is a bitch, and incredibly expensive. To get L running over any kind of load, you need to do so many hacks.