# Datadog savings > What LevelFour finds in your Datadog organization, what triggers each finding, how it prices the saving at your own rate, and how each change ships. Source: https://docs.levelfour.ai/connectors/datadog/findings LevelFour checks your Datadog organization against seven rules: four about Datadog settings that bill more than they return, one about your contract, and two about Datadog costs that land on your AWS bill. Each finding becomes a savings on the **Savings** page, priced at what you pay. ## How the scan works LevelFour scans every 12 hours, from what your Datadog connection already stored: the bill, the usage and the settings under [What LevelFour reads](/connectors/datadog#what-levelfour-reads). A scan makes no calls to Datadog, so it never spends your Datadog rate limits. A rule fires only when the listing it reads came back whole. If your application key lacks the scope a rule needs, that rule stays quiet. Without `metrics_read`, for example, LevelFour sees no query on any metric, and it will not read that as "nobody queries anything". LevelFour groups findings by rule: one savings per rule and Datadog organization, with a line for each metric, index, product or AWS account it covers. [Savings Recommendations](/savings-recommendations) covers reviewing and approving them. When a finding stops qualifying, because someone made the change or the usage moved, the next scan moves a savings nobody acted on to **Unavailable**. ## How LevelFour prices a finding LevelFour prices custom metrics and indexed logs at your own rate: the product's cost on your Datadog bill over the usage Datadog metered for it in the last closed month, or in the last 30 days when that month has neither. On a negotiated contract you pay well under list, and a saving quoted at list would promise money you never get back. When your bill names no matching product, LevelFour falls back to Datadog's published rate. LevelFour prices the two findings about your AWS bill off that bill, from [detailed cost data](/connectors/aws/detailed-cost-data). Each section below says what the saving counts. ## The findings | Finding | What changes | Scopes it needs | Ships as | | ------------------------------------------------------------------------------------------- | ------------------------------------------------- | ------------------------------------------------------------ | ------------------------------------------------- | | [Unused custom metrics](#unused-custom-metrics) | Datadog stops indexing the metric | `metrics_read` | Automated Savings, IaC Pull Request, Manual Setup | | [Tags nobody queries](#tags-nobody-queries) | The metric indexes only its queried tags | `metrics_read` | Automated Savings, IaC Pull Request, Manual Setup | | [Logs kept in Standard too long](#logs-kept-in-standard-too-long) | Days past 15 move to Flex Logs | `logs_read_config` | Automated Savings, IaC Pull Request, Manual Setup | | [Debug and health-check logs](#debug-and-health-check-logs) | An exclusion filter drops them before indexing | `logs_read_config`, `logs_read_data`, `logs_read_index_data` | Automated Savings, IaC Pull Request, Manual Setup | | [Products billing on demand](#products-billing-on-demand) | The commitment goes up at renewal | The billing scopes alone | Manual Setup | | [CloudWatch namespaces nothing reads](#cloudwatch-namespaces-nothing-reads) | Datadog stops polling them | `aws_configuration_read` | Automated Savings, IaC Pull Request, Manual Setup | | [Small archive files moved to colder storage](#small-archive-files-moved-to-colder-storage) | Small files stay where Datadog wrote them | `logs_read_archives` | IaC Pull Request, Manual Setup | | [Synthetic tests outside production](#synthetic-tests-outside-production) | The test runs every 5 minutes | `synthetics_read` | IaC Pull Request, Manual Setup | | [Hosts billed with no Agent](#hosts-billed-with-no-agent) | The AWS integration stops collecting the instance | `hosts_read` | IaC Pull Request, Manual Setup | | [Retention filters keeping every span](#retention-filters-keeping-every-span) | The filter keeps 10 percent of its spans | `apm_retention_filter_read`, `apm_read` | IaC Pull Request, Manual Setup | ### Unused custom metrics LevelFour checks the 100 custom metrics Datadog billed most in the last closed month. A metric qualifies when no query read it in 30 days and no dashboard, monitor, notebook or SLO uses it. The change is an empty Metrics without Limits configuration. Datadog keeps ingesting the metric and stops indexing its tags, so you can list tags again the day someone needs them. **Saving:** the custom metrics the metric averaged per hour last month, at your rate, less what Datadog still bills to ingest it at its published rate. **Ships as:** Automated Savings, IaC Pull Request with a `datadog_metric_tag_configuration` whose `tags` list is empty, or Manual Setup in **Metrics > Summary > Manage Tags**. ### Tags nobody queries A metric your team does query can still index tags no query uses. A metric qualifies when its queries in the last 30 days used only some of the tags it indexes, and Datadog's own estimate says that keeping only those tags indexes fewer series than today. LevelFour skips a metric whose estimate would index more than the metric ingests, because Datadog refuses to save that configuration. The change lists only the queried tags in Metrics without Limits. Datadog keeps ingesting every tag, so you can list a dropped tag again later. Dashboards and monitors that group or filter by the kept tags read the same. A query by a dropped tag sees the metric aggregated over it. **Saving:** the custom metrics the unqueried tags add, by Datadog's estimate of the trimmed configuration, at your rate. **Ships as:** Automated Savings, IaC Pull Request with a `datadog_metric_tag_configuration` that lists the queried tags, or Manual Setup in **Metrics > Summary > Manage Tags**. ### Logs kept in Standard too long A log index qualifies when it keeps more than 15 days in Standard. Log monitors look back two days at most, and nothing records how far back people search in the Log Explorer, so LevelFour keeps 15 days in Standard and moves the rest. The change sets the Standard retention to 15 days and turns on Flex Logs for the rest. The index keeps its total retention: its current retention, or its Flex retention if that is already longer. Logs older than 15 days stay searchable in Flex Logs, where searches run slower and bill for the compute they use. **Saving:** what the index's last 30 days of events cost at your indexed-logs rate, less the same events kept 15 days in Standard and the Flex storage for the days past 15. LevelFour prices the 15 days by scaling your rate by the ratio of Datadog's published prices for the two retentions, so your discount carries into the estimate. A retention between two of Datadog's published tiers takes the lower tier's price, which understates the saving rather than inflating it. **Ships as:** Automated Savings, IaC Pull Request on the `datadog_logs_index` changing `retention_days` and `flex_retention_days`, or Manual Setup in **Logs > Configuration > Indexes**. ### Debug and health-check logs LevelFour samples each index's events over the last week. An index qualifies when debug logs (`status:debug`) or health-check logs (request paths starting `/health`, `/ping`, `/ready` or `/livez`) make up 10 percent or more of its events, and none of its enabled exclusion filters already drops that kind. The change adds an exclusion filter for each kind that drops 100 percent of matching logs before indexing. Datadog still ingests them, so archives, metrics generated from logs and Live Tail keep them. Searches of the index stop returning them, and a monitor that counts them in this index reads zero. **Saving:** the index's indexed-log cost at your rate, times the share the filters drop. Ingestion still bills. **Ships as:** Automated Savings, IaC Pull Request adding `exclusion_filter` blocks to the `datadog_logs_index`, or Manual Setup in **Logs > Configuration > Indexes**. ### Products billing on demand A product qualifies when it billed on demand in at least two of the last three closed months. Datadog bills usage past a commitment at its on-demand rate. The change is a contract change. Before your contract renews, ask your Datadog account team to raise that product's commitment by the usage that billed on demand. Size it to the usage that recurs month after month, because a commitment bills whether or not the usage stays. **Saving:** your average monthly on-demand charge for the product, across the closed months that billed one, times the premium on-demand pricing adds. For a log product, LevelFour takes the 50 percent premium Datadog charges on log usage past a commitment, a third of the charge. For any other product, it takes the gap between Datadog's published on-demand and annual host prices, $18 against $15, a sixth of the charge. **Ships as:** Manual Setup. A contract has no Terraform. [Contract](/connectors/datadog/contract#alert-before-the-on-demand-charge) warns you during the month, before a line's first on-demand charge. A commitment can also run the other way. LevelFour flags a commitment sized above your usage, so you can lower it at renewal instead of paying for what you never use. ### Synthetic tests outside production A test bills per run. A live test qualifies when it runs more often than every 5 minutes and every `env` tag it carries is non-production: `dev`, `stg`, `staging`, `test` or `qa`. A test with no `env` tag or any other value stays out, so LevelFour never touches a production test. **Saving:** the runs you stop, at your effective rate for that test type. **Ships as:** IaC Pull Request and Manual Setup. ### Hosts billed with no Agent The AWS integration bills an EC2 instance as a host even when no Agent runs on it. An instance qualifies when the integration reports it and no Agent does. A tag filter on the integration stops it collecting the instance, and the host stops billing. The instance's `aws.ec2.*` metrics stop reporting, so check that no dashboard or monitor reads them. **Saving:** the hosts you stop collecting, at your effective host rate. **Ships as:** IaC Pull Request and Manual Setup. ### Retention filters keeping every span A retention filter decides which ingested spans stay searchable for 15 days. A custom filter qualifies when it is enabled, keeps every span and matches a broad query. Datadog's default filters keep errors and high-latency traces on their own, so a 10 percent sample keeps the rest in view. **Saving:** the indexed spans you stop keeping, at your effective rate. **Ships as:** IaC Pull Request and Manual Setup. ### CloudWatch namespaces nothing reads Datadog's AWS integration polls CloudWatch for each namespace it collects, and AWS bills the account for every GetMetricData call. An AWS account qualifies when metric collection is on and Datadog polls namespaces whose metrics nothing reads: no dashboard, monitor, notebook or SLO uses them, and no query asked for them in 30 days. The change turns those namespaces off in the account's metric collection, keeping the filter mode the account already uses. Their `aws.*` metrics stop updating in Datadog, and anything that reads them outside Datadog, such as an API export, stops getting data. **Saving:** the account's CloudWatch polling charges on your AWS bill (the `CW:GMD-Metrics` and `CW:Requests` usage types), in proportion to the share of polled namespaces nothing reads. That share is the most you can save, because a namespace can cost less to poll than another. The saving lands on your AWS bill. **Ships as:** Automated Savings, IaC Pull Request changing `namespace_filters` on the `datadog_integration_aws_account`, or Manual Setup in **Integrations > Amazon Web Services > Metric Collection**. ### Small archive files moved to colder storage Datadog writes many small files to a log archive. When the archive's S3 bucket has a lifecycle rule that moves objects to a colder storage class, AWS bills one transition request per file, and for small files those requests cost more than the storage they save. An archive qualifies when Datadog writes it to S3 and its bucket bills lifecycle transition requests (`Requests-Tier3` or `Requests-GDA-Tier3`). The change sets a 128 KB minimum object size on the transition rule and keeps its storage class and days. Files under 128 KB stay in the class Datadog wrote them in. Archives and rehydration keep working. **Saving:** the transition requests the bucket bills on your AWS bill. **Ships as:** IaC Pull Request on the `aws_s3_bucket_lifecycle_configuration`, or Manual Setup in the S3 console. This one is an AWS savings: it appears under AWS, on the account the bucket bills to. ## Shipping a finding Each finding offers **IaC Pull Request**, with the Terraform to merge into the resource that manages the setting, and **Manual Setup**, with the steps in Datadog's own screens, or the S3 console for an archive bucket, and the same Terraform. A product billing on demand needs a contract change, so it offers Manual Setup alone. [Implementation methods](/savings-recommendations/implementation-methods) covers both. The five findings that change a Datadog setting also offer **Automated Savings**: LevelFour makes the change itself, with a write key on your Datadog connection. [Automated Savings](/connectors/datadog/automated-savings) covers the key and each step of the apply. Each savings lists its implementation steps, starting with a check that the finding still holds, such as that nothing reads the metric. ## Next * [Connect Datadog](/connectors/datadog) lists the scopes each read needs * [Contract](/connectors/datadog/contract) projects each contract line to the end of the month * [Automated Savings](/connectors/datadog/automated-savings) lets LevelFour apply a finding you approved * [Savings Audit](/savings-audit) records each saving once it is applied