Add support for variables

In the Drupal 8+ versions at least, the query hits both the messages and the variables table, so what am I missing?

I see the same user names (often well-known at stopforumspam.com, or obvious ones like "Administrator") again and again, and I would be happy to block these IPs with a Threshold of 1.

You could setup a rule with a REGEXP query for user.*Administrator which would hit against the variables table. It is ashame that the the module doesn't let you specify a search query containing one part for the message column and the other part for the variables column.

If you try this, you'll want to test heavily for false positives, with either Autoban rule test feature, or with SQL queries:

SELECT * FROM watchdog WHERE `variables` REGEXP 'user.*Administrator'