I have created two incidents, one is for all Http 5xx errors using the default measurements
HTTP 5xx Response (internal) ,
HTTP 5xx Response on Transaction Entry
but when I create a incident alert with custom measurments for response codes 500 and 401 using web request ,response status code by setting the regex value as 401|500 seems like it doesnt get triggered ,
Please see the below useful links to understand and use the RegEx.
I am sure this will be really helpful for you.