Repository: google/timesketch

Issue:
Retrieve event comment using python api
**Is your feature request related to a problem? Please describe.**
It would be useful if we could retrieve event comments via the python api client.  

**Describe the solution you'd like**
Either:
* implement new functionality in the python api client using the endpoint (preferred):
```/sketches/{sketch_id}/event/?searchindex_id={searchindex_id}&event_id={eventid}```
* update the Search object to include comment data in the 'table' method.  

**Describe alternatives you've considered**
None at this point.

**Additional context**
N/A



Discussion:

Resolving patch:
diff --git a/api_client/python/timesketch_api_client/sketch.py b/api_client/python/timesketch_api_client/sketch.py
--- a/api_client/python/timesketch_api_client/sketch.py
+++ b/api_client/python/timesketch_api_client/sketch.py
@@ -1342,6 +1342,30 @@ def comment_event(self, event_id, index, comment_text):
         response = self.api.session.post(resource_url, json=form_data)
         return error.get_response_json(response, logger)
 
+    def get_event(self, event_id, index_id):
+        """Gets information about an event, including raw event and meta data.
+
+        Args:
+            event_id: id of the event.
+            index_id: The OpenSearch index identifier.
+
+        Returns:
+            a json data containing the event details.
+        """
+        if self.is_archived():
+            raise RuntimeError("Unable to retrieve an event in an archived sketch.")
+
+        resource_url_base = "{0:s}/sketches/{1:d}/event/".format(
+            self.api.api_root, self.id
+        )
+
+        resource_url_params = "?searchindex_id={0:s}&event_id={1:s}".format(
+            index_id, event_id
+        )
+
+        response = self.api.session.get(resource_url_base + resource_url_params)
+        return error.get_response_json(response, logger)
+
     def label_events(self, events, label_name):
         """Labels one or more events with label_name.
 


Test patch:
diff --git a/api_client/python/timesketch_api_client/sketch_test.py b/api_client/python/timesketch_api_client/sketch_test.py
--- a/api_client/python/timesketch_api_client/sketch_test.py
+++ b/api_client/python/timesketch_api_client/sketch_test.py
@@ -47,3 +47,11 @@ def test_get_timelines(self):
         self.assertIsInstance(timelines, list)
         self.assertEqual(len(timelines), 2)
         self.assertIsInstance(timelines[0], timeline_lib.Timeline)
+
+    def test_get_event(self):
+        """Test to get event data."""
+        event_data = self.sketch.get_event(
+            event_id="test_event", index_id="test_index")
+        self.assertIsInstance(event_data, dict)
+        self.assertTrue('meta' in event_data)
+        self.assertTrue('comments' in event_data['meta'])
diff --git a/api_client/python/timesketch_api_client/test_lib.py b/api_client/python/timesketch_api_client/test_lib.py
--- a/api_client/python/timesketch_api_client/test_lib.py
+++ b/api_client/python/timesketch_api_client/test_lib.py
@@ -79,6 +79,23 @@ def json(self):
         "sketch_name": "test",
     }
 
+    event_data_1 = {
+        "meta": {
+            "comments": [
+                {
+                    "comment": "test comment",
+                    "created_at": "Wed, 18 May 2022 01:23:45 GMT",
+                    "id": 1,
+                    "updated_at": "Wed, 18 May 2022 01:23:45 GMT",
+                    "user": {
+                        "username": "testuser"
+                    }
+                }
+            ]
+        },
+        "objects": {}
+    }
+
     sketch_data = {
         "meta": {
             "views": [{"id": 1, "name": "test"}, {"id": 2, "name": "test"}],
@@ -301,6 +318,9 @@ def json(self):
         "http://127.0.0.1": MockResponse(text_data=auth_text_data),
         "http://127.0.0.1/api/v1/sketches/": MockResponse(json_data=sketch_list_data),
         "http://127.0.0.1/api/v1/sketches/1": MockResponse(json_data=sketch_data),
+        "http://127.0.0.1/api/v1/sketches/1/event/?searchindex_id=test_index&event_id=test_event": MockResponse(  # pylint: disable=line-too-long
+            json_data=event_data_1
+        ),
         "http://127.0.0.1/api/v1/sketches/1/views/1/": MockResponse(
             json_data=view_data_1
         ),