Automated Savings

Your Datadog connection reads with one application key, which cannot change anything. To have LevelFour apply savings for you, add a second application key to the connection, with write scopes only. LevelFour keeps every read on the first key and makes each change with the second.

Datadog has no access that expires on its own, so the write key can change these settings across your Datadog organization until you revoke it. LevelFour uses it only for savings you approve.

Ask your LevelFour contact to turn on Automated Savings for Datadog for your organization. Until then, each Datadog saving offers IaC Pull Request and Manual Setup, or Manual Setup alone for a contract change.

What LevelFour can apply

Saving	What LevelFour does	Scope it uses
Unused custom metrics	Saves a Metrics without Limits configuration that lists no tags	`metric_tags_write`
Tags nobody queries	Saves a Metrics without Limits configuration that lists only the queried tags	`metric_tags_write`
Logs kept in Standard too long	Sets the index's Standard retention to 15 days and keeps its total retention in Flex Logs	`logs_modify_indexes`
Debug and health-check logs	Adds one exclusion filter, named `LevelFour: drop` and the kinds it drops, after the index's own filters	`logs_modify_indexes`
CloudWatch namespaces nothing reads	Turns those namespaces off in the AWS account's namespace filter, in the mode the account already uses	`aws_configuration_edit`
Products billing on demand	Nothing: a contract change is Manual Setup only	None
Small archive files moved to colder storage	Nothing in Datadog: AWS bills the bucket, so this one ships as an AWS savings	None

You can take each change back in Datadog: list a metric's tags again, set an index's retention back, turn off the exclusion filter, or turn a namespace on again.

If Terraform manages the setting, choose Automated Savings + IaC Pull Request. LevelFour applies the change first, then opens a pull request with the matching Terraform, so your next apply does not put the old configuration back.

Add the write key

Create the key in Datadog

On the service account that holds your read key, create a second application key with these scopes and no others:

metric_tags_write
logs_modify_indexes
aws_configuration_edit

Add it to the connection

Under Connect Providers > Datadog, click Rotate credential on the connection. Paste the API key and the read key again, paste the new key in Write application key (optional), then save. On a new connection, paste it when you connect.

How LevelFour applies a change

Approve the savings

Accept the savings in LevelFour and choose Automated Savings, or Automated Savings + IaC Pull Request. LevelFour cannot run it until your Datadog connection holds a write key.

LevelFour checks it still holds

A LevelFour engineer starts each run after you approve. LevelFour reads the resource again with the read key and leaves it untouched when it no longer qualifies: a query read the metric, someone added an exclusion filter for those logs, or Datadog stopped polling those namespaces.

For a tag configuration, LevelFour reads Datadog's estimate just before the change, and sends it only when Datadog says it indexes fewer series than the metric does now and no more than it ingests. For an AWS account, LevelFour stops when the change would turn off every namespace the account polls, since that turns its metric collection off.

The engineer reads the exact request the run will send before confirming it.

LevelFour makes the change

LevelFour sends one write with the write key. A log index takes its whole configuration in one request, so LevelFour sends the index back as Datadog returned it, with only the retention or the exclusion filters changed. Then it reads the resource again with the read key to confirm Datadog holds the new configuration.

Confirming it worked

The savings moves to Optimized. Its Status & Logs step lists the approval, the re-check and what it found, and the request LevelFour sent, such as PATCH /api/v2/metrics/<metric>/tags, with the result.

In Datadog, the metric's Manage Tags lists the kept tags, the index shows its new retention or the LevelFour: drop filter, and the AWS account's Metric Collection shows the namespaces turned off.

Removing access

Under Connect Providers > Datadog, click Rotate credential, paste the API key and the read key, and tick Remove this key on the write key. Then revoke the write key in Datadog. LevelFour keeps reading with the read key.

Connect Datadog covers removing the whole connection.

Troubleshooting

Status & Logs shows a warning that LevelFour left the resource unchanged. Someone changed the resource after LevelFour found it, so it no longer qualifies. LevelFour made no change, and the next scan updates or retires the savings.

The run failed and Status & Logs shows Datadog refused the request. The write key lacks the scope that change uses. Create a key with all three scopes, add it as Add the write key describes, and retry.

The run failed because a read after the change did not show it. Datadog accepted the request and did not return the new configuration straight after. Check the setting in Datadog before you retry.

Datadog savings explains each finding and how LevelFour prices it
Implementation methods compares Automated Savings with IaC Pull Request and Manual Setup