diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
index a3fba8f8ed10..f6840a747848 100644
--- a/CHANGELOG.next.asciidoc
+++ b/CHANGELOG.next.asciidoc
@@ -73,6 +73,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Fix goroutine leak happening when harvesters are dynamically stopped. {pull}11263[11263]
 - Fix `add_docker_metadata` source matching, using `log.file.path` field now. {pull}11577[11577]
 - Add missing Kubernetes metadata fields to Filebeat CoreDNS module, and fix a documentation error. {pull}11591[11591]
+- Reduce memory usage if long lines are truncated to fit `max_bytes` limit. The line buffer is copied into a smaller buffer now. This allows the runtime to release unused memory earlier. {pull}11524[11524]
 
 *Heartbeat*
 
diff --git a/libbeat/reader/readfile/limit.go b/libbeat/reader/readfile/limit.go
index aff5fac67345..403dea958476 100644
--- a/libbeat/reader/readfile/limit.go
+++ b/libbeat/reader/readfile/limit.go
@@ -18,6 +18,8 @@
 package readfile
 
 import (
+	"fmt"
+
 	"github.com/elastic/beats/libbeat/reader"
 )
 
@@ -37,7 +39,12 @@ func NewLimitReader(r reader.Reader, maxBytes int) *LimitReader {
 func (r *LimitReader) Next() (reader.Message, error) {
 	message, err := r.reader.Next()
 	if len(message.Content) > r.maxBytes {
-		message.Content = message.Content[:r.maxBytes]
+		tmp := make([]byte, r.maxBytes)
+		n := copy(tmp, message.Content)
+		if n != r.maxBytes {
+			return message, fmt.Errorf("unexpected number of bytes were copied, %d instead of limit %d", n, r.maxBytes)
+		}
+		message.Content = tmp
 		message.AddFlagsWithKey("log.flags", "truncated")
 	}
 	return message, err