The invention discloses a mass network data search method based on a data stream structure. The method comprises a real-time data storage method and a real-time query method. Data in a network arrives in a data stream form, so that it is needed to reduce the network data, capture a specific length of each piece of network message data and store valid information according to a specific data file size. According to the method, a Bloom Filter algorithm is used to establish an index file for a source IP and a host IP in each network message; and during real-time query, the index file is searched for first, a data storage file is searched for after matching succeeds, and detailed information is obtained. Through the method, mass network data can be quickly processed, a small storage space is occupied, and a large amount of network detailed information is saved; by use of the Bloom Filter Hash algorithm to establish indexes for the network message data, grading retrieval of file content is realized, the index structure is simple, and the occupied space is small; by use of three different Hash functions for calculation, the Hash conflict rate is low; and during retrieval, index matching search is quick and accurate, and high time and space efficiency is achieved.