# Automated Savings

> Let LevelFour apply a Datadog saving you approved, with a write key you add to your Datadog connection and revoke whenever you choose.

Source: https://docs.levelfour.ai/connectors/datadog/automated-savings


Your Datadog connection reads with one application key, which cannot change anything. To have LevelFour apply savings for you, add a second application key to the connection, with write scopes only. LevelFour keeps every read on the first key and makes each change with the second.

Datadog has no access that expires on its own, so the write key can change these settings across your Datadog organization until you revoke it. LevelFour uses it only for savings you approve.

Ask your LevelFour contact to turn on Automated Savings for Datadog for your organization. Until then, each Datadog saving offers **IaC Pull Request** and **Manual Setup**, or Manual Setup alone for a contract change.

## What LevelFour can apply

| Saving                                                                                                                  | What LevelFour does                                                                                      | Scope it uses            |
| ----------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------- | ------------------------ |
| [Unused custom metrics](/connectors/datadog/findings#unused-custom-metrics)                                             | Saves a Metrics without Limits configuration that lists no tags                                          | `metric_tags_write`      |
| [Tags nobody queries](/connectors/datadog/findings#tags-nobody-queries)                                                 | Saves a Metrics without Limits configuration that lists only the queried tags                            | `metric_tags_write`      |
| [Logs kept in Standard too long](/connectors/datadog/findings#logs-kept-in-standard-too-long)                           | Sets the index's Standard retention to 15 days and keeps its total retention in Flex Logs                | `logs_modify_indexes`    |
| [Debug and health-check logs](/connectors/datadog/findings#debug-and-health-check-logs)                                 | Adds one exclusion filter, named `LevelFour: drop` and the kinds it drops, after the index's own filters | `logs_modify_indexes`    |
| [CloudWatch namespaces nothing reads](/connectors/datadog/findings#cloudwatch-namespaces-nothing-reads)                 | Turns those namespaces off in the AWS account's namespace filter, in the mode the account already uses   | `aws_configuration_edit` |
| [Products billing on demand](/connectors/datadog/findings#products-billing-on-demand)                                   | Nothing: a contract change is Manual Setup only                                                          | None                     |
| [Small archive files moved to colder storage](/connectors/datadog/findings#small-archive-files-moved-to-colder-storage) | Nothing in Datadog: AWS bills the bucket, so this one ships as an AWS savings                            | None                     |

You can take each change back in Datadog: list a metric's tags again, set an index's retention back, turn off the exclusion filter, or turn a namespace on again.

If Terraform manages the setting, choose **Automated Savings + IaC Pull Request**. LevelFour applies the change first, then opens a pull request with the matching Terraform, so your next apply does not put the old configuration back.

## Add the write key

### Create the key in Datadog

On the service account that holds your read key, create a second application key with these scopes and no others:

* `metric_tags_write`
* `logs_modify_indexes`
* `aws_configuration_edit`

### Add it to the connection

Under **Connect Providers > Datadog**, click **Rotate credential** on the connection. Paste the API key and the read key again, paste the new key in **Write application key (optional)**, then save. On a new connection, paste it when you [connect](/connectors/datadog#connect).

## How LevelFour applies a change

### Approve the savings

Accept the savings in LevelFour and choose **Automated Savings**, or **Automated Savings + IaC Pull Request**. LevelFour cannot run it until your Datadog connection holds a write key.

### LevelFour checks it still holds

A LevelFour engineer starts each run after you approve. LevelFour reads the resource again with the read key and leaves it untouched when it no longer qualifies: a query read the metric, someone added an exclusion filter for those logs, or Datadog stopped polling those namespaces.

For a tag configuration, LevelFour reads Datadog's estimate just before the change, and sends it only when Datadog says it indexes fewer series than the metric does now and no more than it ingests. For an AWS account, LevelFour stops when the change would turn off every namespace the account polls, since that turns its metric collection off.

The engineer reads the exact request the run will send before confirming it.

### LevelFour makes the change

LevelFour sends one write with the write key. A log index takes its whole configuration in one request, so LevelFour sends the index back as Datadog returned it, with only the retention or the exclusion filters changed. Then it reads the resource again with the read key to confirm Datadog holds the new configuration.

## Confirming it worked

The savings moves to **Optimized**. Its **Status & Logs** step lists the approval, the re-check and what it found, and the request LevelFour sent, such as `PATCH /api/v2/metrics/<metric>/tags`, with the result.

In Datadog, the metric's **Manage Tags** lists the kept tags, the index shows its new retention or the `LevelFour: drop` filter, and the AWS account's **Metric Collection** shows the namespaces turned off.

## Removing access

Under **Connect Providers > Datadog**, click **Rotate credential**, paste the API key and the read key, and tick **Remove this key** on the write key. Then revoke the write key in Datadog. LevelFour keeps reading with the read key.

[Connect Datadog](/connectors/datadog#removing-access) covers removing the whole connection.

## Troubleshooting

**Status & Logs shows a warning that LevelFour left the resource unchanged.**
Someone changed the resource after LevelFour found it, so it no longer qualifies. LevelFour made no change, and the next scan updates or retires the savings.

**The run failed and Status & Logs shows Datadog refused the request.**
The write key lacks the scope that change uses. Create a key with all three scopes, add it as [Add the write key](#add-the-write-key) describes, and [retry](/savings-recommendations/approvals-and-rollout#when-a-run-fails).

**The run failed because a read after the change did not show it.**
Datadog accepted the request and did not return the new configuration straight after. Check the setting in Datadog before you retry.

## Next

* [Datadog savings](/connectors/datadog/findings) explains each finding and how LevelFour prices it
* [Implementation methods](/savings-recommendations/implementation-methods) compares Automated Savings with IaC Pull Request and Manual Setup