SELECT 
    element.rulegroupid,
    element.terminatingrule.ruleid AS ruleid,
    element.terminatingrule.action AS action,
    action,
    httprequest.clientip as IP

FROM 
    waf_logs
CROSS JOIN UNNEST(rulegrouplist) AS t(element)
WHERE action = 'BLOCK'