$re = '/(?<=[\w])(?:_([a-z]))([^_"]*+)(?!"\s)|"_([a-z]+)"/';
$str = '{
"_id": "1",
"point_altitude": 530,
"equipment_id": "3325",
"header": {
"raw_message": "",
"message_type_id_ext": "ping_event"
}
}';
$subst = "\"$3\"\U$1\E$2";
$result = preg_replace($re, $subst, $str);
echo "The result of the substitution is ".$result;
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php