$re = '/\A((?:(?!127\.0\.0\.1\s)[\s\S])*?)(?:\Z|127\.0\.0\.1\s+(?!localhost)\S+\n|(127\.0\.1\.1\s+\S+(?![\s\S]*\n127\.0\.0\.1\s)\n))/';
$str = '127.0.1.1 myhost
1.1.1.1 bla
127.0.0.1 bla
2.2.2.2 bla
';
$subst = "\1\2127.0.0.1 localhost\n";
$result = preg_replace($re, $subst, $str, 1);
echo "The result of the substitution is ".$result;
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php