I found a way:
processors:
- replace:
fields:
- field: "system.filesystem.mount_point"
pattern: "\\\\"
replacement: ""
ignore_missing: false
fail_on_error: true
one single \ needs to be espaced three times!