Connect Datadog

LevelFour reads Datadog with your organization API key and an application key on a service account. The application key's scopes decide what LevelFour reads. Two billing scopes bring in your cost and usage. The read scopes add the custom metrics, log indexes, log archives and AWS integration that Datadog savings checks. With read scopes only, the key cannot change anything in your Datadog organization. An optional second key with write scopes lets LevelFour apply the savings you approve.

Prerequisites

Datadog Pro or Enterprise.
Your parent organization. Datadog serves cost only to a parent organization and refuses a key from a sub-organization.
An admin of the parent organization, to create a service account and its application key.

Connect

Copy your organization API key

Sign in to Datadog as an admin of your parent organization. Go to Organization Settings, then API Keys, and copy your organization API key.

Create a service account

Go to Organization Settings, then Service Accounts, and create a service account with the Datadog Admin Role, or a custom role with the same permissions. Datadog keeps billing and usage to that role, and an application key cannot do more than its owner. The scopes in the next step keep LevelFour to reading.

Create a read application key

On that service account, click New Key and name the key. Datadog creates it with a name only, so copy its value now. Then open the key, click Edit beside Scope, click Select All Read, untick the seven scopes below and save. You set this up once.

Untick api_keys_read, client_tokens_read, org_app_keys_read, synthetics_global_variable_read, coterm_read, rum_session_replay_read and dbm_parameterized_queries_read. LevelFour needs no credential, no terminal or session recording and no SQL text. The filter box above the list finds each one.

A key with no scopes carries the whole role, so LevelFour refuses it and does not keep it. The table says what LevelFour reads today.

Scope	What LevelFour reads	Needed
`usage_read` and `billing_read`	Estimated and historical cost per product, and hourly usage	Yes. Datadog refuses either one alone
`metrics_read`	Custom metrics, their tags and what uses them	No
`monitors_read`, `dashboards_read`, `notebooks_read` and `slos_read`	The monitors, dashboards, notebooks and SLOs that hold a custom metric, so LevelFour never calls one in use unused	No
`logs_read_config`	Log indexes: retention, Flex retention, daily limit and exclusion filters	No
`logs_read_data` and `logs_read_index_data`	The share of each index's events that are debug or health-check logs. LevelFour counts logs per index and never fetches a log line	No
`logs_read_archives`	Log archives and the bucket each one writes to	No
`aws_configuration_read`	The AWS integration: each AWS account and the CloudWatch namespaces Datadog polls	No
`synthetics_read`, `hosts_read`, `apm_read`, `apm_retention_filter_read` and `rum_apps_read`	Synthetic tests, hosts, APM retention filters and RUM applications	No
`teams_read` and `timeseries_query`	Datadog Teams, and the usage metrics Datadog reports ahead of its billing data	No
Every other read scope	Nothing yet. LevelFour asks for them now so a later view needs no new key	No

A read scope you leave out hides only what it reads. Your costs keep importing, and the savings that need that scope stay quiet. Datadog savings lists the scopes each finding needs.

Add a write key, if you want Automated Savings

To let LevelFour apply the savings you approve, create a second application key on the same service account, with the write scopes Automated Savings lists and no others. LevelFour keeps reading with the first key. Leave the write key out and LevelFour stays read-only.

Add it to LevelFour

Open Connect Providers, select Datadog and click Add API key. Paste the API key and the application key, and the write key in Write application key (optional) if you made one. Choose your Datadog site, then click Connect account.

Your site is the domain you sign in to Datadog on: datadoghq.com, us3.datadoghq.com, us5.datadoghq.com, datadoghq.eu, ap1.datadoghq.com or ap2.datadoghq.com.

To split Datadog spend by team, fill in Team tag keys as well. See Spend by team.

Spend by team

LevelFour splits each closed month of Datadog spend by up to three tag keys, using Datadog's own cost attribution. Tag reports and virtual tags then group Datadog by team, next to your cloud, SaaS and AI spend.

LevelFour reads the tag keys your Datadog usage attribution is configured with first. When Datadog names none, it uses the keys you entered in Team tag keys: up to three, separated by commas, such as team,service.

The parts of each bill line add back to the line to the cent. A product that Datadog's attribution names under no tag stays whole and untagged.
The current month has no team split. Datadog attributes a closed month by the 19th of the next one, and that month has no team until then.

What LevelFour reads

Data	Scope	Detail
Cost	`usage_read`, `billing_read`	Estimated cost per product and charge type, committed or on demand, day by day for the current and previous month. Historical cost for each closed month
Usage	`usage_read`	Hourly usage per product, rolled up to the day
Cost by team	`usage_read`, `billing_read`	Each closed month split by your attribution tag keys
Custom metrics	`metrics_read`	The 100 custom metrics Datadog billed most in the last closed month: whether a query read each one in 30 days, the dashboards, monitors, notebooks and SLOs that use it, its indexed and ingested volume, its queried and indexed tags, and Datadog's estimate for a configuration that keeps only the queried tags
Log indexes	`logs_read_config`	Retention, Flex retention, daily limit, enabled exclusion filters, and the events each index took in the last 30 days
Log sample	`logs_read_data`, `logs_read_index_data`	Each index's events over the last week: all of them, `status:debug` and health-check paths
Log archives	`logs_read_archives`	Each archive's destination, bucket, path and AWS account
AWS integration	`aws_configuration_read`	Each AWS account's namespace filter and regions, which CloudWatch namespaces report metrics, and whether anything reads them

Your Datadog contract comes from the same bill: LevelFour reads it off the committed charges after each sync.

Confirming it worked

The connection moves to Connected. Your first data appears within a day.

If the connection shows Warning, LevelFour still imports your costs. The troubleshooting table explains each warning.

Rotating or removing access

Rotating the credential

Create a new application key in Datadog the same way. Under Connect Providers > Datadog, click Rotate credential on the connection and paste the keys, then revoke the old application key in Datadog. Leave Write application key (optional) untouched and LevelFour keeps your write key. After three rotations in a row that keep it, LevelFour asks you to paste it again.

To add a read scope you left out, create a key that has it and rotate the same way.

Removing access

Disconnect Datadog under Connect Providers, then revoke the application keys in Datadog's Organization Settings. To keep the connection and remove only the write key, follow Automated Savings.

Troubleshooting

Symptom	What to do
The connection is refused with a permissions error	Confirm the application key has both `usage_read` and `billing_read`, and that its service account has the Datadog Admin Role or a custom role with the same permissions. A scope cannot give a key more than its owner holds
The connection is refused because the key has no scopes	A key with no scopes carries every permission of its service account, so LevelFour refused it and did not keep it. Create a key with the scopes in Connect and connect again
The connection is refused even with both scopes	Datadog serves cost only to the parent organization. A key from a sub-organization does not work, so create it in the parent organization
The connection is refused because the site is not a Datadog site	Pick the site you sign in to Datadog on, from the list in the dialog
The connection shows Warning about missing scopes	The application key lacks a read scope, so LevelFour could not list what that scope covers and the savings that need it stay quiet. Create a key with the scopes in Connect and rotate it
The connection shows Warning that team attribution is unavailable	Datadog refused cost attribution to your plan or your key. Your costs import whole, without teams
The connection shows Warning that team attribution is not configured	Neither your Datadog usage attribution nor Team tag keys names a tag key. Configure the tag keys in Datadog's usage attribution, and LevelFour reads them on the next sync
Recent days keep changing	Expected for products Datadog bills on peak (p95 or p99) usage, such as hosts and containers. LevelFour spreads their month-to-date cost evenly over the days so far
A closed month changes after it ends	Datadog closes a month's cost by the 16th of the next month and its cost attribution by the 19th. LevelFour reads the previous month again through the 20th

Contract shows your Datadog contract against this month's usage, projected to the end of the month
Datadog savings lists what LevelFour finds in your Datadog organization and how each change ships
Automated Savings lets LevelFour apply a saving you approved, with the write key
Connect Providers lists every provider you can connect