The invention discloses a rapid association classification and hierarchical storage method for network security logs, which comprises the following steps: defining an XML (Extensible Markup Language) format log template according to different application metadata, the log template comprising alarm log information, association flow log information, application metadata log information, message log information and file attachment log information; associating the alarm logs, the associated flow logs, the application metadata logs, the message logs and the file attachment logs together through flow and transaction information in the logs, wherein each alarm log outputs a complete log; performing hierarchical storage mechanism output on logs, including values in alarm log information, associated flow log information, application metadata log information, message log information and file attachment log information; the hierarchical storage mechanism adopts two levels, the first level adopts a memory file system, and the second level adopts an SSD/HD storage system with RAID. According to the technical scheme, the performance problem of Json log format output is solved.